Merge branch 'main' into auth/pm-27084/register-accepts-new-data-types

src/Admin/AdminConsole/Controllers/OrganizationsController.cs

@@ -14,8 +14,10 @@ using Bit.Core.AdminConsole.Providers.Interfaces;
 using Bit.Core.AdminConsole.Repositories;
 using Bit.Core.Billing.Enums;
 using Bit.Core.Billing.Extensions;
+using Bit.Core.Billing.Organizations.Services;
 using Bit.Core.Billing.Pricing;
 using Bit.Core.Billing.Providers.Services;
+using Bit.Core.Billing.Services;
 using Bit.Core.Enums;
 using Bit.Core.Models.OrganizationConnectionConfigs;
 using Bit.Core.OrganizationFeatures.OrganizationSponsorships.FamiliesForEnterprise.Interfaces;
@@ -41,7 +43,7 @@ public class OrganizationsController : Controller
     private readonly ICollectionRepository _collectionRepository;
     private readonly IGroupRepository _groupRepository;
     private readonly IPolicyRepository _policyRepository;
-    private readonly IPaymentService _paymentService;
+    private readonly IStripePaymentService _paymentService;
     private readonly IApplicationCacheService _applicationCacheService;
     private readonly GlobalSettings _globalSettings;
     private readonly IProviderRepository _providerRepository;
@@ -56,6 +58,7 @@ public class OrganizationsController : Controller
     private readonly IOrganizationInitiateDeleteCommand _organizationInitiateDeleteCommand;
     private readonly IPricingClient _pricingClient;
     private readonly IResendOrganizationInviteCommand _resendOrganizationInviteCommand;
+    private readonly IOrganizationBillingService _organizationBillingService;
 
     public OrganizationsController(
         IOrganizationRepository organizationRepository,
@@ -66,7 +69,7 @@ public class OrganizationsController : Controller
         ICollectionRepository collectionRepository,
         IGroupRepository groupRepository,
         IPolicyRepository policyRepository,
-        IPaymentService paymentService,
+        IStripePaymentService paymentService,
         IApplicationCacheService applicationCacheService,
         GlobalSettings globalSettings,
         IProviderRepository providerRepository,
@@ -80,7 +83,8 @@ public class OrganizationsController : Controller
         IProviderBillingService providerBillingService,
         IOrganizationInitiateDeleteCommand organizationInitiateDeleteCommand,
         IPricingClient pricingClient,
-        IResendOrganizationInviteCommand resendOrganizationInviteCommand)
+        IResendOrganizationInviteCommand resendOrganizationInviteCommand,
+        IOrganizationBillingService organizationBillingService)
     {
         _organizationRepository = organizationRepository;
         _organizationUserRepository = organizationUserRepository;
@@ -105,6 +109,7 @@ public class OrganizationsController : Controller
         _organizationInitiateDeleteCommand = organizationInitiateDeleteCommand;
         _pricingClient = pricingClient;
         _resendOrganizationInviteCommand = resendOrganizationInviteCommand;
+        _organizationBillingService = organizationBillingService;
     }
 
     [RequirePermission(Permission.Org_List_View)]
@@ -241,6 +246,8 @@ public class OrganizationsController : Controller
         var existingOrganizationData = new Organization
         {
             Id = organization.Id,
+            Name = organization.Name,
+            BillingEmail = organization.BillingEmail,
             Status = organization.Status,
             PlanType = organization.PlanType,
             Seats = organization.Seats
@@ -286,6 +293,22 @@ public class OrganizationsController : Controller
 
         await _applicationCacheService.UpsertOrganizationAbilityAsync(organization);
 
+        // Sync name/email changes to Stripe
+        if (existingOrganizationData.Name != organization.Name || existingOrganizationData.BillingEmail != organization.BillingEmail)
+        {
+            try
+            {
+                await _organizationBillingService.UpdateOrganizationNameAndEmail(organization);
+            }
+            catch (Exception ex)
+            {
+                _logger.LogError(ex,
+                    "Failed to update Stripe customer for organization {OrganizationId}. Database was updated successfully.",
+                    organization.Id);
+                TempData["Warning"] = "Organization updated successfully, but Stripe customer name/email synchronization failed.";
+            }
+        }
+
         return RedirectToAction("Edit", new { id });
     }
 

src/Admin/AdminConsole/Controllers/ProvidersController.cs

@@ -56,6 +56,7 @@ public class ProvidersController : Controller
     private readonly IStripeAdapter _stripeAdapter;
     private readonly IAccessControlService _accessControlService;
     private readonly ISubscriberService _subscriberService;
+    private readonly ILogger<ProvidersController> _logger;
 
     public ProvidersController(IOrganizationRepository organizationRepository,
         IResellerClientOrganizationSignUpCommand resellerClientOrganizationSignUpCommand,
@@ -72,7 +73,8 @@ public class ProvidersController : Controller
         IPricingClient pricingClient,
         IStripeAdapter stripeAdapter,
         IAccessControlService accessControlService,
-        ISubscriberService subscriberService)
+        ISubscriberService subscriberService,
+        ILogger<ProvidersController> logger)
     {
         _organizationRepository = organizationRepository;
         _resellerClientOrganizationSignUpCommand = resellerClientOrganizationSignUpCommand;
@@ -92,6 +94,7 @@ public class ProvidersController : Controller
         _braintreeMerchantUrl = webHostEnvironment.GetBraintreeMerchantUrl();
         _braintreeMerchantId = globalSettings.Braintree.MerchantId;
         _subscriberService = subscriberService;
+        _logger = logger;
     }
 
     [RequirePermission(Permission.Provider_List_View)]
@@ -296,6 +299,9 @@ public class ProvidersController : Controller
 
         var originalProviderStatus = provider.Enabled;
 
+        // Capture original billing email before modifications for Stripe sync
+        var originalBillingEmail = provider.BillingEmail;
+
         model.ToProvider(provider);
 
         // validate the stripe ids to prevent saving a bad one
@@ -321,6 +327,22 @@ public class ProvidersController : Controller
         await _providerService.UpdateAsync(provider);
         await _applicationCacheService.UpsertProviderAbilityAsync(provider);
 
+        // Sync billing email changes to Stripe
+        if (!string.IsNullOrEmpty(provider.GatewayCustomerId) && originalBillingEmail != provider.BillingEmail)
+        {
+            try
+            {
+                await _providerBillingService.UpdateProviderNameAndEmail(provider);
+            }
+            catch (Exception ex)
+            {
+                _logger.LogError(ex,
+                    "Failed to update Stripe customer for provider {ProviderId}. Database was updated successfully.",
+                    provider.Id);
+                TempData["Warning"] = "Provider updated successfully, but Stripe customer email synchronization failed.";
+            }
+        }
+
         if (!provider.IsBillable())
         {
             return RedirectToAction("Edit", new { id });
@@ -339,11 +361,11 @@ public class ProvidersController : Controller
                     ]);
                 await _providerBillingService.UpdateSeatMinimums(updateMspSeatMinimumsCommand);
 
-                var customer = await _stripeAdapter.CustomerGetAsync(provider.GatewayCustomerId);
+                var customer = await _stripeAdapter.GetCustomerAsync(provider.GatewayCustomerId);
                 if (model.PayByInvoice != customer.ApprovedToPayByInvoice())
                 {
                     var approvedToPayByInvoice = model.PayByInvoice ? "1" : "0";
-                    await _stripeAdapter.CustomerUpdateAsync(customer.Id, new CustomerUpdateOptions
+                    await _stripeAdapter.UpdateCustomerAsync(customer.Id, new CustomerUpdateOptions
                     {
                         Metadata = new Dictionary<string, string>
                         {

src/Admin/Controllers/ToolsController.cs

@@ -8,6 +8,7 @@ using Bit.Admin.Utilities;
 using Bit.Core.AdminConsole.Entities;
 using Bit.Core.AdminConsole.Repositories;
 using Bit.Core.Billing.Organizations.Queries;
+using Bit.Core.Billing.Services;
 using Bit.Core.Entities;
 using Bit.Core.Platform.Installations;
 using Bit.Core.Repositories;

src/Admin/Controllers/UsersController.cs

@@ -5,6 +5,7 @@ using Bit.Admin.Models;
 using Bit.Admin.Services;
 using Bit.Admin.Utilities;
 using Bit.Core.Auth.UserFeatures.TwoFactorAuth.Interfaces;
+using Bit.Core.Billing.Services;
 using Bit.Core.Repositories;
 using Bit.Core.Services;
 using Bit.Core.Settings;
@@ -20,7 +21,7 @@ public class UsersController : Controller
 {
     private readonly IUserRepository _userRepository;
     private readonly ICipherRepository _cipherRepository;
-    private readonly IPaymentService _paymentService;
+    private readonly IStripePaymentService _paymentService;
     private readonly GlobalSettings _globalSettings;
     private readonly IAccessControlService _accessControlService;
     private readonly ITwoFactorIsEnabledQuery _twoFactorIsEnabledQuery;
@@ -30,7 +31,7 @@ public class UsersController : Controller
     public UsersController(
         IUserRepository userRepository,
         ICipherRepository cipherRepository,
-        IPaymentService paymentService,
+        IStripePaymentService paymentService,
         GlobalSettings globalSettings,
         IAccessControlService accessControlService,
         ITwoFactorIsEnabledQuery twoFactorIsEnabledQuery,

src/Admin/Dockerfile

@@ -1,7 +1,7 @@
 ###############################################
 #           Node.js build stage               #
 ###############################################
-FROM node:20-alpine3.21 AS node-build
+FROM --platform=$BUILDPLATFORM node:20-alpine3.21 AS node-build
 
 WORKDIR /app
 COPY src/Admin/package*.json ./

src/Api/AdminConsole/Controllers/OrganizationIntegrationConfigurationController.cs

@@ -1,8 +1,8 @@
 using Bit.Api.AdminConsole.Models.Request.Organizations;
 using Bit.Api.AdminConsole.Models.Response.Organizations;
+using Bit.Core.AdminConsole.EventIntegrations.OrganizationIntegrationConfigurations.Interfaces;
 using Bit.Core.Context;
 using Bit.Core.Exceptions;
-using Bit.Core.Repositories;
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 
@@ -12,8 +12,10 @@ namespace Bit.Api.AdminConsole.Controllers;
 [Authorize("Application")]
 public class OrganizationIntegrationConfigurationController(
     ICurrentContext currentContext,
-    IOrganizationIntegrationRepository integrationRepository,
-    IOrganizationIntegrationConfigurationRepository integrationConfigurationRepository) : Controller
+    ICreateOrganizationIntegrationConfigurationCommand createCommand,
+    IUpdateOrganizationIntegrationConfigurationCommand updateCommand,
+    IDeleteOrganizationIntegrationConfigurationCommand deleteCommand,
+    IGetOrganizationIntegrationConfigurationsQuery getQuery) : Controller
 {
     [HttpGet("")]
     public async Task<List<OrganizationIntegrationConfigurationResponseModel>> GetAsync(
@@ -24,13 +26,8 @@ public class OrganizationIntegrationConfigurationController(
         {
             throw new NotFoundException();
         }
-        var integration = await integrationRepository.GetByIdAsync(integrationId);
-        if (integration == null || integration.OrganizationId != organizationId)
-        {
-            throw new NotFoundException();
-        }
 
-        var configurations = await integrationConfigurationRepository.GetManyByIntegrationAsync(integrationId);
+        var configurations = await getQuery.GetManyByIntegrationAsync(organizationId, integrationId);
         return configurations
             .Select(configuration => new OrganizationIntegrationConfigurationResponseModel(configuration))
             .ToList();
@@ -46,19 +43,11 @@ public class OrganizationIntegrationConfigurationController(
         {
             throw new NotFoundException();
         }
-        var integration = await integrationRepository.GetByIdAsync(integrationId);
-        if (integration == null || integration.OrganizationId != organizationId)
-        {
-            throw new NotFoundException();
-        }
-        if (!model.IsValidForType(integration.Type))
-        {
-            throw new BadRequestException($"Invalid Configuration and/or Template for integration type {integration.Type}");
-        }
 
-        var organizationIntegrationConfiguration = model.ToOrganizationIntegrationConfiguration(integrationId);
-        var configuration = await integrationConfigurationRepository.CreateAsync(organizationIntegrationConfiguration);
-        return new OrganizationIntegrationConfigurationResponseModel(configuration);
+        var configuration = model.ToOrganizationIntegrationConfiguration(integrationId);
+        var created = await createCommand.CreateAsync(organizationId, integrationId, configuration);
+
+        return new OrganizationIntegrationConfigurationResponseModel(created);
     }
 
     [HttpPut("{configurationId:guid}")]
@@ -72,26 +61,11 @@ public class OrganizationIntegrationConfigurationController(
         {
             throw new NotFoundException();
         }
-        var integration = await integrationRepository.GetByIdAsync(integrationId);
-        if (integration == null || integration.OrganizationId != organizationId)
-        {
-            throw new NotFoundException();
-        }
-        if (!model.IsValidForType(integration.Type))
-        {
-            throw new BadRequestException($"Invalid Configuration and/or Template for integration type {integration.Type}");
-        }
 
-        var configuration = await integrationConfigurationRepository.GetByIdAsync(configurationId);
-        if (configuration is null || configuration.OrganizationIntegrationId != integrationId)
-        {
-            throw new NotFoundException();
-        }
+        var configuration = model.ToOrganizationIntegrationConfiguration(integrationId);
+        var updated = await updateCommand.UpdateAsync(organizationId, integrationId, configurationId, configuration);
 
-        var newConfiguration = model.ToOrganizationIntegrationConfiguration(configuration);
-        await integrationConfigurationRepository.ReplaceAsync(newConfiguration);
-
-        return new OrganizationIntegrationConfigurationResponseModel(newConfiguration);
+        return new OrganizationIntegrationConfigurationResponseModel(updated);
     }
 
     [HttpDelete("{configurationId:guid}")]
@@ -101,19 +75,8 @@ public class OrganizationIntegrationConfigurationController(
         {
             throw new NotFoundException();
         }
-        var integration = await integrationRepository.GetByIdAsync(integrationId);
-        if (integration == null || integration.OrganizationId != organizationId)
-        {
-            throw new NotFoundException();
-        }
 
-        var configuration = await integrationConfigurationRepository.GetByIdAsync(configurationId);
-        if (configuration is null || configuration.OrganizationIntegrationId != integrationId)
-        {
-            throw new NotFoundException();
-        }
-
-        await integrationConfigurationRepository.DeleteAsync(configuration);
+        await deleteCommand.DeleteAsync(organizationId, integrationId, configurationId);
     }
 
     [HttpPost("{configurationId:guid}/delete")]

src/Api/AdminConsole/Controllers/ProvidersController.cs

@@ -5,6 +5,7 @@ using Bit.Api.AdminConsole.Models.Request.Providers;
 using Bit.Api.AdminConsole.Models.Response.Providers;
 using Bit.Core.AdminConsole.Repositories;
 using Bit.Core.AdminConsole.Services;
+using Bit.Core.Billing.Providers.Services;
 using Bit.Core.Context;
 using Bit.Core.Exceptions;
 using Bit.Core.Services;
@@ -23,15 +24,20 @@ public class ProvidersController : Controller
     private readonly IProviderService _providerService;
     private readonly ICurrentContext _currentContext;
     private readonly GlobalSettings _globalSettings;
+    private readonly IProviderBillingService _providerBillingService;
+    private readonly ILogger<ProvidersController> _logger;
 
     public ProvidersController(IUserService userService, IProviderRepository providerRepository,
-        IProviderService providerService, ICurrentContext currentContext, GlobalSettings globalSettings)
+        IProviderService providerService, ICurrentContext currentContext, GlobalSettings globalSettings,
+        IProviderBillingService providerBillingService, ILogger<ProvidersController> logger)
     {
         _userService = userService;
         _providerRepository = providerRepository;
         _providerService = providerService;
         _currentContext = currentContext;
         _globalSettings = globalSettings;
+        _providerBillingService = providerBillingService;
+        _logger = logger;
     }
 
     [HttpGet("{id:guid}")]
@@ -65,7 +71,27 @@ public class ProvidersController : Controller
             throw new NotFoundException();
         }
 
+        // Capture original values before modifications for Stripe sync
+        var originalName = provider.Name;
+        var originalBillingEmail = provider.BillingEmail;
+
         await _providerService.UpdateAsync(model.ToProvider(provider, _globalSettings));
+
+        // Sync name/email changes to Stripe
+        if (originalName != provider.Name || originalBillingEmail != provider.BillingEmail)
+        {
+            try
+            {
+                await _providerBillingService.UpdateProviderNameAndEmail(provider);
+            }
+            catch (Exception ex)
+            {
+                _logger.LogError(ex,
+                    "Failed to update Stripe customer for provider {ProviderId}. Database was updated successfully.",
+                    provider.Id);
+            }
+        }
+
         return new ProviderResponseModel(provider);
     }
 

src/Api/AdminConsole/Models/Request/Organizations/OrganizationIntegrationConfigurationRequestModel.cs

@@ -1,6 +1,4 @@
-using System.Text.Json;
-using Bit.Core.AdminConsole.Entities;
-using Bit.Core.AdminConsole.Models.Data.EventIntegrations;
+using Bit.Core.AdminConsole.Entities;
 using Bit.Core.Enums;
 
 
@@ -16,38 +14,6 @@ public class OrganizationIntegrationConfigurationRequestModel
 
     public string? Template { get; set; }
 
-    public bool IsValidForType(IntegrationType integrationType)
-    {
-        switch (integrationType)
-        {
-            case IntegrationType.CloudBillingSync or IntegrationType.Scim:
-                return false;
-            case IntegrationType.Slack:
-                return !string.IsNullOrWhiteSpace(Template) &&
-                       IsConfigurationValid<SlackIntegrationConfiguration>() &&
-                       IsFiltersValid();
-            case IntegrationType.Webhook:
-                return !string.IsNullOrWhiteSpace(Template) &&
-                       IsConfigurationValid<WebhookIntegrationConfiguration>() &&
-                       IsFiltersValid();
-            case IntegrationType.Hec:
-                return !string.IsNullOrWhiteSpace(Template) &&
-                       Configuration is null &&
-                       IsFiltersValid();
-            case IntegrationType.Datadog:
-                return !string.IsNullOrWhiteSpace(Template) &&
-                       Configuration is null &&
-                       IsFiltersValid();
-            case IntegrationType.Teams:
-                return !string.IsNullOrWhiteSpace(Template) &&
-                       Configuration is null &&
-                       IsFiltersValid();
-            default:
-                return false;
-
-        }
-    }
-
     public OrganizationIntegrationConfiguration ToOrganizationIntegrationConfiguration(Guid organizationIntegrationId)
     {
         return new OrganizationIntegrationConfiguration()
@@ -59,50 +25,4 @@ public class OrganizationIntegrationConfigurationRequestModel
             Template = Template
         };
     }
-
-    public OrganizationIntegrationConfiguration ToOrganizationIntegrationConfiguration(OrganizationIntegrationConfiguration currentConfiguration)
-    {
-        currentConfiguration.Configuration = Configuration;
-        currentConfiguration.EventType = EventType;
-        currentConfiguration.Filters = Filters;
-        currentConfiguration.Template = Template;
-
-        return currentConfiguration;
-    }
-
-    private bool IsConfigurationValid<T>()
-    {
-        if (string.IsNullOrWhiteSpace(Configuration))
-        {
-            return false;
-        }
-
-        try
-        {
-            var config = JsonSerializer.Deserialize<T>(Configuration);
-            return config is not null;
-        }
-        catch
-        {
-            return false;
-        }
-    }
-
-    private bool IsFiltersValid()
-    {
-        if (Filters is null)
-        {
-            return true;
-        }
-
-        try
-        {
-            var filters = JsonSerializer.Deserialize<IntegrationFilterGroup>(Filters);
-            return filters is not null;
-        }
-        catch
-        {
-            return false;
-        }
-    }
 }

src/Api/AdminConsole/Public/Controllers/MembersController.cs

@@ -6,6 +6,7 @@ using Bit.Core.AdminConsole.OrganizationFeatures.OrganizationUsers.Interfaces;
 using Bit.Core.AdminConsole.OrganizationFeatures.OrganizationUsers.InviteUsers;
 using Bit.Core.AdminConsole.Repositories;
 using Bit.Core.Auth.UserFeatures.TwoFactorAuth.Interfaces;
+using Bit.Core.Billing.Services;
 using Bit.Core.Context;
 using Bit.Core.Repositories;
 using Bit.Core.Services;
@@ -24,7 +25,7 @@ public class MembersController : Controller
     private readonly ICurrentContext _currentContext;
     private readonly IUpdateOrganizationUserCommand _updateOrganizationUserCommand;
     private readonly IUpdateOrganizationUserGroupsCommand _updateOrganizationUserGroupsCommand;
-    private readonly IPaymentService _paymentService;
+    private readonly IStripePaymentService _paymentService;
     private readonly IOrganizationRepository _organizationRepository;
     private readonly ITwoFactorIsEnabledQuery _twoFactorIsEnabledQuery;
     private readonly IRemoveOrganizationUserCommand _removeOrganizationUserCommand;
@@ -37,7 +38,7 @@ public class MembersController : Controller
         ICurrentContext currentContext,
         IUpdateOrganizationUserCommand updateOrganizationUserCommand,
         IUpdateOrganizationUserGroupsCommand updateOrganizationUserGroupsCommand,
-        IPaymentService paymentService,
+        IStripePaymentService paymentService,
         IOrganizationRepository organizationRepository,
         ITwoFactorIsEnabledQuery twoFactorIsEnabledQuery,
         IRemoveOrganizationUserCommand removeOrganizationUserCommand,

src/Api/AdminConsole/Public/Models/Response/GroupResponseModel.cs

@@ -2,6 +2,7 @@
 #nullable disable
 
 using System.ComponentModel.DataAnnotations;
+using System.Text.Json.Serialization;
 using Bit.Api.Models.Public.Response;
 using Bit.Core.AdminConsole.Entities;
 using Bit.Core.Models.Data;
@@ -13,6 +14,12 @@ namespace Bit.Api.AdminConsole.Public.Models.Response;
 /// </summary>
 public class GroupResponseModel : GroupBaseModel, IResponseModel
 {
+    [JsonConstructor]
+    public GroupResponseModel()
+    {
+
+    }
+
     public GroupResponseModel(Group group, IEnumerable<CollectionAccessSelection> collections)
     {
         if (group == null)

src/Api/Auth/Controllers/AccountsController.cs

@@ -18,6 +18,7 @@ using Bit.Core.Auth.UserFeatures.UserMasterPassword.Interfaces;
 using Bit.Core.Enums;
 using Bit.Core.Exceptions;
 using Bit.Core.KeyManagement.Kdf;
+using Bit.Core.KeyManagement.Models.Data;
 using Bit.Core.KeyManagement.Queries.Interfaces;
 using Bit.Core.Models.Api.Response;
 using Bit.Core.Repositories;
@@ -44,6 +45,7 @@ public class AccountsController : Controller
     private readonly IUserAccountKeysQuery _userAccountKeysQuery;
     private readonly ITwoFactorEmailService _twoFactorEmailService;
     private readonly IChangeKdfCommand _changeKdfCommand;
+    private readonly IUserRepository _userRepository;
 
     public AccountsController(
         IOrganizationService organizationService,
@@ -57,7 +59,8 @@ public class AccountsController : Controller
         IFeatureService featureService,
         IUserAccountKeysQuery userAccountKeysQuery,
         ITwoFactorEmailService twoFactorEmailService,
-        IChangeKdfCommand changeKdfCommand
+        IChangeKdfCommand changeKdfCommand,
+        IUserRepository userRepository
         )
     {
         _organizationService = organizationService;
@@ -72,6 +75,7 @@ public class AccountsController : Controller
         _userAccountKeysQuery = userAccountKeysQuery;
         _twoFactorEmailService = twoFactorEmailService;
         _changeKdfCommand = changeKdfCommand;
+        _userRepository = userRepository;
     }
 
 
@@ -432,16 +436,36 @@ public class AccountsController : Controller
             throw new UnauthorizedAccessException();
         }
 
-        if (_featureService.IsEnabled(FeatureFlagKeys.ReturnErrorOnExistingKeypair))
+        if (!string.IsNullOrWhiteSpace(user.PrivateKey) || !string.IsNullOrWhiteSpace(user.PublicKey))
         {
-            if (!string.IsNullOrWhiteSpace(user.PrivateKey) || !string.IsNullOrWhiteSpace(user.PublicKey))
-            {
-                throw new BadRequestException("User has existing keypair");
-            }
+            throw new BadRequestException("User has existing keypair");
+        }
+
+        if (model.AccountKeys != null)
+        {
+            var accountKeysData = model.AccountKeys.ToAccountKeysData();
+            if (!accountKeysData.IsV2Encryption())
+            {
+                throw new BadRequestException("AccountKeys are only supported for V2 encryption.");
+            }
+            await _userRepository.SetV2AccountCryptographicStateAsync(user.Id, accountKeysData);
+            return new KeysResponseModel(accountKeysData, user.Key);
+        }
+        else
+        {
+            // Todo: Drop this after a transition period. This will drop no-account-keys requests.
+            // The V1 check in the other branch should persist
+            // https://bitwarden.atlassian.net/browse/PM-27329
+            await _userService.SaveUserAsync(model.ToUser(user));
+            return new KeysResponseModel(new UserAccountKeysData
+            {
+                PublicKeyEncryptionKeyPairData = new PublicKeyEncryptionKeyPairData(
+                    user.PrivateKey,
+                    user.PublicKey
+                )
+            }, user.Key);
         }
 
-        await _userService.SaveUserAsync(model.ToUser(user));
-        return new KeysResponseModel(user);
     }
 
     [HttpGet("keys")]
@@ -453,7 +477,8 @@ public class AccountsController : Controller
             throw new UnauthorizedAccessException();
         }
 
-        return new KeysResponseModel(user);
+        var accountKeys = await _userAccountKeysQuery.Run(user);
+        return new KeysResponseModel(accountKeys, user.Key);
     }
 
     [HttpDelete]

src/Api/Billing/Controllers/AccountsBillingController.cs

@@ -10,7 +10,7 @@ namespace Bit.Api.Billing.Controllers;
 [Route("accounts/billing")]
 [Authorize("Application")]
 public class AccountsBillingController(
-    IPaymentService paymentService,
+    IStripePaymentService paymentService,
     IUserService userService,
     IPaymentHistoryService paymentHistoryService) : Controller
 {

src/Api/Billing/Controllers/AccountsController.cs

@@ -79,7 +79,7 @@ public class AccountsController(
     [HttpGet("subscription")]
     public async Task<SubscriptionResponseModel> GetSubscriptionAsync(
         [FromServices] GlobalSettings globalSettings,
-        [FromServices] IPaymentService paymentService)
+        [FromServices] IStripePaymentService paymentService)
     {
         var user = await userService.GetUserByPrincipalAsync(User);
         if (user == null)

src/Api/Billing/Controllers/LicensesController.cs

@@ -0,0 +1,91 @@
+// FIXME: Update this file to be null safe and then delete the line below
+#nullable disable
+
+using Bit.Core.AdminConsole.OrganizationFeatures.OrganizationConnections.Interfaces;
+using Bit.Core.Billing.Models.Business;
+using Bit.Core.Billing.Organizations.Models;
+using Bit.Core.Billing.Organizations.Queries;
+using Bit.Core.Context;
+using Bit.Core.Exceptions;
+using Bit.Core.Models.Api.OrganizationLicenses;
+using Bit.Core.Repositories;
+using Bit.Core.Services;
+using Bit.Core.Utilities;
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+
+namespace Bit.Api.Billing.Controllers;
+
+[Route("licenses")]
+[Authorize("Licensing")]
+[SelfHosted(NotSelfHostedOnly = true)]
+public class LicensesController : Controller
+{
+    private readonly IUserRepository _userRepository;
+    private readonly IUserService _userService;
+    private readonly IOrganizationRepository _organizationRepository;
+    private readonly IGetCloudOrganizationLicenseQuery _getCloudOrganizationLicenseQuery;
+    private readonly IValidateBillingSyncKeyCommand _validateBillingSyncKeyCommand;
+    private readonly ICurrentContext _currentContext;
+
+    public LicensesController(
+        IUserRepository userRepository,
+        IUserService userService,
+        IOrganizationRepository organizationRepository,
+        IGetCloudOrganizationLicenseQuery getCloudOrganizationLicenseQuery,
+        IValidateBillingSyncKeyCommand validateBillingSyncKeyCommand,
+        ICurrentContext currentContext)
+    {
+        _userRepository = userRepository;
+        _userService = userService;
+        _organizationRepository = organizationRepository;
+        _getCloudOrganizationLicenseQuery = getCloudOrganizationLicenseQuery;
+        _validateBillingSyncKeyCommand = validateBillingSyncKeyCommand;
+        _currentContext = currentContext;
+    }
+
+    [HttpGet("user/{id}")]
+    public async Task<UserLicense> GetUser(string id, [FromQuery] string key)
+    {
+        var user = await _userRepository.GetByIdAsync(new Guid(id));
+        if (user == null)
+        {
+            return null;
+        }
+        else if (!user.LicenseKey.Equals(key))
+        {
+            await Task.Delay(2000);
+            throw new BadRequestException("Invalid license key.");
+        }
+
+        var license = await _userService.GenerateLicenseAsync(user, null);
+        return license;
+    }
+
+    /// <summary>
+    /// Used by self-hosted installations to get an updated license file
+    /// </summary>
+    [HttpGet("organization/{id}")]
+    public async Task<OrganizationLicense> OrganizationSync(string id, [FromBody] SelfHostedOrganizationLicenseRequestModel model)
+    {
+        var organization = await _organizationRepository.GetByIdAsync(new Guid(id));
+        if (organization == null)
+        {
+            throw new NotFoundException("Organization not found.");
+        }
+
+        if (!organization.LicenseKey.Equals(model.LicenseKey))
+        {
+            await Task.Delay(2000);
+            throw new BadRequestException("Invalid license key.");
+        }
+
+        if (!await _validateBillingSyncKeyCommand.ValidateBillingSyncKeyAsync(organization, model.BillingSyncKey))
+        {
+            throw new BadRequestException("Invalid Billing Sync Key");
+        }
+
+        var license = await _getCloudOrganizationLicenseQuery.GetLicenseAsync(organization, _currentContext.InstallationId.Value);
+        return license;
+    }
+}

src/Api/Billing/Controllers/OrganizationBillingController.cs

@@ -5,7 +5,6 @@ using Bit.Core.Billing.Providers.Services;
 using Bit.Core.Billing.Services;
 using Bit.Core.Context;
 using Bit.Core.Repositories;
-using Bit.Core.Services;
 using Bit.Core.Utilities;
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
@@ -19,7 +18,7 @@ public class OrganizationBillingController(
     ICurrentContext currentContext,
     IOrganizationBillingService organizationBillingService,
     IOrganizationRepository organizationRepository,
-    IPaymentService paymentService,
+    IStripePaymentService paymentService,
     IPaymentHistoryService paymentHistoryService) : BaseBillingController
 {
     // TODO: Remove when pm-25379-use-new-organization-metadata-structure is removed.

src/Api/Billing/Controllers/OrganizationsController.cs

@@ -36,7 +36,7 @@ public class OrganizationsController(
     IOrganizationUserRepository organizationUserRepository,
     IOrganizationService organizationService,
     IUserService userService,
-    IPaymentService paymentService,
+    IStripePaymentService paymentService,
     ICurrentContext currentContext,
     IGetCloudOrganizationLicenseQuery getCloudOrganizationLicenseQuery,
     GlobalSettings globalSettings,

src/Api/Billing/Controllers/ProviderBillingController.cs

@@ -43,7 +43,7 @@ public class ProviderBillingController(
             return result;
         }
 
-        var invoices = await stripeAdapter.InvoiceListAsync(new StripeInvoiceListOptions
+        var invoices = await stripeAdapter.ListInvoicesAsync(new StripeInvoiceListOptions
         {
             Customer = provider.GatewayCustomerId
         });
@@ -87,7 +87,7 @@ public class ProviderBillingController(
             return result;
         }
 
-        var subscription = await stripeAdapter.SubscriptionGetAsync(provider.GatewaySubscriptionId,
+        var subscription = await stripeAdapter.GetSubscriptionAsync(provider.GatewaySubscriptionId,
             new SubscriptionGetOptions { Expand = ["customer.tax_ids", "discounts", "test_clock"] });
 
         var providerPlans = await providerPlanRepository.GetByProviderId(provider.Id);
@@ -96,7 +96,7 @@ public class ProviderBillingController(
         {
             var plan = await pricingClient.GetPlanOrThrow(providerPlan.PlanType);
             var priceId = ProviderPriceAdapter.GetPriceId(provider, subscription, plan.Type);
-            var price = await stripeAdapter.PriceGetAsync(priceId);
+            var price = await stripeAdapter.GetPriceAsync(priceId);
 
             var unitAmount = price.UnitAmountDecimal.HasValue
                 ? price.UnitAmountDecimal.Value / 100M

src/Api/Billing/Controllers/StripeController.cs

@@ -1,5 +1,5 @@
-using Bit.Core.Billing.Tax.Services;
-using Bit.Core.Services;
+using Bit.Core.Billing.Services;
+using Bit.Core.Billing.Tax.Services;
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Http.HttpResults;
 using Microsoft.AspNetCore.Mvc;
@@ -28,7 +28,7 @@ public class StripeController(
             Usage = "off_session"
         };
 
-        var setupIntent = await stripeAdapter.SetupIntentCreate(options);
+        var setupIntent = await stripeAdapter.CreateSetupIntentAsync(options);
 
         return TypedResults.Ok(setupIntent.ClientSecret);
     }
@@ -43,7 +43,7 @@ public class StripeController(
             Usage = "off_session"
         };
 
-        var setupIntent = await stripeAdapter.SetupIntentCreate(options);
+        var setupIntent = await stripeAdapter.CreateSetupIntentAsync(options);
 
         return TypedResults.Ok(setupIntent.ClientSecret);
     }

src/Api/Controllers/PhishingDomainsController.cs

@@ -1,34 +0,0 @@
-using Bit.Core;
-using Bit.Core.Repositories;
-using Bit.Core.Services;
-using Microsoft.AspNetCore.Mvc;
-
-namespace Bit.Api.Controllers;
-
-[Route("phishing-domains")]
-public class PhishingDomainsController(IPhishingDomainRepository phishingDomainRepository, IFeatureService featureService) : Controller
-{
-    [HttpGet]
-    public async Task<ActionResult<ICollection<string>>> GetPhishingDomainsAsync()
-    {
-        if (!featureService.IsEnabled(FeatureFlagKeys.PhishingDetection))
-        {
-            return NotFound();
-        }
-
-        var domains = await phishingDomainRepository.GetActivePhishingDomainsAsync();
-        return Ok(domains);
-    }
-
-    [HttpGet("checksum")]
-    public async Task<ActionResult<string>> GetChecksumAsync()
-    {
-        if (!featureService.IsEnabled(FeatureFlagKeys.PhishingDetection))
-        {
-            return NotFound();
-        }
-
-        var checksum = await phishingDomainRepository.GetCurrentChecksumAsync();
-        return Ok(checksum);
-    }
-}

src/Api/Dirt/Controllers/EventsController.cs

@@ -1,6 +1,7 @@
 // FIXME: Update this file to be null safe and then delete the line below
 #nullable disable
 
+using Bit.Api.Dirt.Models.Response;
 using Bit.Api.Models.Response;
 using Bit.Api.Utilities;
 using Bit.Api.Utilities.DiagnosticTools;
@@ -17,7 +18,7 @@ using Bit.Core.Vault.Repositories;
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 
-namespace Bit.Api.Controllers;
+namespace Bit.Api.Dirt.Controllers;
 
 [Route("events")]
 [Authorize("Application")]

src/Api/Dirt/Models/Response/EventResponseModel.cs

@@ -2,7 +2,7 @@
 using Bit.Core.Models.Api;
 using Bit.Core.Models.Data;
 
-namespace Bit.Api.Models.Response;
+namespace Bit.Api.Dirt.Models.Response;
 
 public class EventResponseModel : ResponseModel
 {

src/Api/Dirt/Public/Controllers/EventsController.cs

@@ -1,6 +1,5 @@
-
-using System.Net;
-using Bit.Api.Models.Public.Request;
+using System.Net;
+using Bit.Api.Dirt.Public.Models;
 using Bit.Api.Models.Public.Response;
 using Bit.Api.Utilities.DiagnosticTools;
 using Bit.Core.Context;
@@ -12,7 +11,7 @@ using Bit.Core.Vault.Repositories;
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 
-namespace Bit.Api.Public.Controllers;
+namespace Bit.Api.Dirt.Public.Controllers;
 
 [Route("public/events")]
 [Authorize("Organization")]

src/Api/Dirt/Public/Models/EventFilterRequestModel.cs

@@ -3,7 +3,7 @@
 
 using Bit.Core.Exceptions;
 
-namespace Bit.Api.Models.Public.Request;
+namespace Bit.Api.Dirt.Public.Models;
 
 public class EventFilterRequestModel
 {

src/Api/Dirt/Public/Models/EventResponseModel.cs

@@ -1,8 +1,9 @@
 using System.ComponentModel.DataAnnotations;
+using Bit.Api.Models.Public.Response;
 using Bit.Core.Enums;
 using Bit.Core.Models.Data;
 
-namespace Bit.Api.Models.Public.Response;
+namespace Bit.Api.Dirt.Public.Models;
 
 /// <summary>
 /// An event log.

src/Api/Jobs/JobsHostedService.cs

@@ -59,13 +59,6 @@ public class JobsHostedService : BaseJobsHostedService
             .StartNow()
             .WithCronSchedule("0 0 * * * ?")
             .Build();
-        var updatePhishingDomainsTrigger = TriggerBuilder.Create()
-            .WithIdentity("UpdatePhishingDomainsTrigger")
-            .StartNow()
-            .WithSimpleSchedule(x => x
-                .WithIntervalInHours(24)
-                .RepeatForever())
-            .Build();
         var updateOrgSubscriptionsTrigger = TriggerBuilder.Create()
             .WithIdentity("UpdateOrgSubscriptionsTrigger")
             .StartNow()
@@ -81,7 +74,6 @@ public class JobsHostedService : BaseJobsHostedService
             new Tuple<Type, ITrigger>(typeof(ValidateUsersJob), everyTopOfTheSixthHourTrigger),
             new Tuple<Type, ITrigger>(typeof(ValidateOrganizationsJob), everyTwelfthHourAndThirtyMinutesTrigger),
             new Tuple<Type, ITrigger>(typeof(ValidateOrganizationDomainJob), validateOrganizationDomainTrigger),
-            new Tuple<Type, ITrigger>(typeof(UpdatePhishingDomainsJob), updatePhishingDomainsTrigger),
             new (typeof(OrganizationSubscriptionUpdateJob), updateOrgSubscriptionsTrigger),
         };
 
@@ -111,7 +103,6 @@ public class JobsHostedService : BaseJobsHostedService
         services.AddTransient<ValidateUsersJob>();
         services.AddTransient<ValidateOrganizationsJob>();
         services.AddTransient<ValidateOrganizationDomainJob>();
-        services.AddTransient<UpdatePhishingDomainsJob>();
         services.AddTransient<OrganizationSubscriptionUpdateJob>();
     }
 

src/Api/Jobs/UpdatePhishingDomainsJob.cs

@@ -1,97 +0,0 @@
-using Bit.Core;
-using Bit.Core.Jobs;
-using Bit.Core.PhishingDomainFeatures.Interfaces;
-using Bit.Core.Repositories;
-using Bit.Core.Services;
-using Bit.Core.Settings;
-using Quartz;
-
-namespace Bit.Api.Jobs;
-
-public class UpdatePhishingDomainsJob : BaseJob
-{
-    private readonly GlobalSettings _globalSettings;
-    private readonly IPhishingDomainRepository _phishingDomainRepository;
-    private readonly ICloudPhishingDomainQuery _cloudPhishingDomainQuery;
-    private readonly IFeatureService _featureService;
-    public UpdatePhishingDomainsJob(
-        GlobalSettings globalSettings,
-        IPhishingDomainRepository phishingDomainRepository,
-        ICloudPhishingDomainQuery cloudPhishingDomainQuery,
-        IFeatureService featureService,
-        ILogger<UpdatePhishingDomainsJob> logger)
-        : base(logger)
-    {
-        _globalSettings = globalSettings;
-        _phishingDomainRepository = phishingDomainRepository;
-        _cloudPhishingDomainQuery = cloudPhishingDomainQuery;
-        _featureService = featureService;
-    }
-
-    protected override async Task ExecuteJobAsync(IJobExecutionContext context)
-    {
-        if (!_featureService.IsEnabled(FeatureFlagKeys.PhishingDetection))
-        {
-            _logger.LogInformation(Constants.BypassFiltersEventId, "Skipping phishing domain update. Feature flag is disabled.");
-            return;
-        }
-
-        if (string.IsNullOrWhiteSpace(_globalSettings.PhishingDomain?.UpdateUrl))
-        {
-            _logger.LogInformation(Constants.BypassFiltersEventId, "Skipping phishing domain update. No URL configured.");
-            return;
-        }
-
-        if (_globalSettings.SelfHosted && !_globalSettings.EnableCloudCommunication)
-        {
-            _logger.LogInformation(Constants.BypassFiltersEventId, "Skipping phishing domain update. Cloud communication is disabled in global settings.");
-            return;
-        }
-
-        var remoteChecksum = await _cloudPhishingDomainQuery.GetRemoteChecksumAsync();
-        if (string.IsNullOrWhiteSpace(remoteChecksum))
-        {
-            _logger.LogWarning(Constants.BypassFiltersEventId, "Could not retrieve remote checksum. Skipping update.");
-            return;
-        }
-
-        var currentChecksum = await _phishingDomainRepository.GetCurrentChecksumAsync();
-
-        if (string.Equals(currentChecksum, remoteChecksum, StringComparison.OrdinalIgnoreCase))
-        {
-            _logger.LogInformation(Constants.BypassFiltersEventId,
-                "Phishing domains list is up to date (checksum: {Checksum}). Skipping update.",
-                currentChecksum);
-            return;
-        }
-
-        _logger.LogInformation(Constants.BypassFiltersEventId,
-            "Checksums differ (current: {CurrentChecksum}, remote: {RemoteChecksum}). Fetching updated domains from {Source}.",
-            currentChecksum, remoteChecksum, _globalSettings.SelfHosted ? "Bitwarden cloud API" : "external source");
-
-        try
-        {
-            var domains = await _cloudPhishingDomainQuery.GetPhishingDomainsAsync();
-            if (!domains.Contains("phishing.testcategory.com", StringComparer.OrdinalIgnoreCase))
-            {
-                domains.Add("phishing.testcategory.com");
-            }
-
-            if (domains.Count > 0)
-            {
-                _logger.LogInformation(Constants.BypassFiltersEventId, "Updating {Count} phishing domains with checksum {Checksum}.",
-                    domains.Count, remoteChecksum);
-                await _phishingDomainRepository.UpdatePhishingDomainsAsync(domains, remoteChecksum);
-                _logger.LogInformation(Constants.BypassFiltersEventId, "Successfully updated phishing domains.");
-            }
-            else
-            {
-                _logger.LogWarning(Constants.BypassFiltersEventId, "No valid domains found in the response. Skipping update.");
-            }
-        }
-        catch (Exception ex)
-        {
-            _logger.LogError(Constants.BypassFiltersEventId, ex, "Error updating phishing domains.");
-        }
-    }
-}

src/Api/KeyManagement/Controllers/AccountsKeyManagementController.cs

@@ -47,6 +47,7 @@ public class AccountsKeyManagementController : Controller
         _webauthnKeyValidator;
     private readonly IRotationValidator<IEnumerable<OtherDeviceKeysUpdateRequestModel>, IEnumerable<Device>> _deviceValidator;
     private readonly IKeyConnectorConfirmationDetailsQuery _keyConnectorConfirmationDetailsQuery;
+    private readonly ISetKeyConnectorKeyCommand _setKeyConnectorKeyCommand;
 
     public AccountsKeyManagementController(IUserService userService,
         IFeatureService featureService,
@@ -62,8 +63,10 @@ public class AccountsKeyManagementController : Controller
             emergencyAccessValidator,
         IRotationValidator<IEnumerable<ResetPasswordWithOrgIdRequestModel>, IReadOnlyList<OrganizationUser>>
             organizationUserValidator,
-        IRotationValidator<IEnumerable<WebAuthnLoginRotateKeyRequestModel>, IEnumerable<WebAuthnLoginRotateKeyData>> webAuthnKeyValidator,
-        IRotationValidator<IEnumerable<OtherDeviceKeysUpdateRequestModel>, IEnumerable<Device>> deviceValidator)
+        IRotationValidator<IEnumerable<WebAuthnLoginRotateKeyRequestModel>, IEnumerable<WebAuthnLoginRotateKeyData>>
+            webAuthnKeyValidator,
+        IRotationValidator<IEnumerable<OtherDeviceKeysUpdateRequestModel>, IEnumerable<Device>> deviceValidator,
+        ISetKeyConnectorKeyCommand setKeyConnectorKeyCommand)
     {
         _userService = userService;
         _featureService = featureService;
@@ -79,6 +82,7 @@ public class AccountsKeyManagementController : Controller
         _webauthnKeyValidator = webAuthnKeyValidator;
         _deviceValidator = deviceValidator;
         _keyConnectorConfirmationDetailsQuery = keyConnectorConfirmationDetailsQuery;
+        _setKeyConnectorKeyCommand = setKeyConnectorKeyCommand;
     }
 
     [HttpPost("key-management/regenerate-keys")]
@@ -146,18 +150,28 @@ public class AccountsKeyManagementController : Controller
             throw new UnauthorizedAccessException();
         }
 
-        var result = await _userService.SetKeyConnectorKeyAsync(model.ToUser(user), model.Key, model.OrgIdentifier);
-        if (result.Succeeded)
+        if (model.IsV2Request())
         {
-            return;
+            // V2 account registration
+            await _setKeyConnectorKeyCommand.SetKeyConnectorKeyForUserAsync(user, model.ToKeyConnectorKeysData());
         }
-
-        foreach (var error in result.Errors)
+        else
         {
-            ModelState.AddModelError(string.Empty, error.Description);
-        }
+            // V1 account registration
+            // TODO removed with https://bitwarden.atlassian.net/browse/PM-27328
+            var result = await _userService.SetKeyConnectorKeyAsync(model.ToUser(user), model.Key, model.OrgIdentifier);
+            if (result.Succeeded)
+            {
+                return;
+            }
 
-        throw new BadRequestException(ModelState);
+            foreach (var error in result.Errors)
+            {
+                ModelState.AddModelError(string.Empty, error.Description);
+            }
+
+            throw new BadRequestException(ModelState);
+        }
     }
 
     [HttpPost("convert-to-key-connector")]

src/Api/KeyManagement/Models/Requests/SetKeyConnectorKeyRequestModel.cs

@@ -1,36 +1,112 @@
-// FIXME: Update this file to be null safe and then delete the line below
-#nullable disable
-
-using System.ComponentModel.DataAnnotations;
+using System.ComponentModel.DataAnnotations;
 using Bit.Core.Auth.Models.Api.Request.Accounts;
 using Bit.Core.Entities;
 using Bit.Core.Enums;
+using Bit.Core.Exceptions;
+using Bit.Core.KeyManagement.Models.Api.Request;
+using Bit.Core.KeyManagement.Models.Data;
+using Bit.Core.Utilities;
 
 namespace Bit.Api.KeyManagement.Models.Requests;
 
-public class SetKeyConnectorKeyRequestModel
+public class SetKeyConnectorKeyRequestModel : IValidatableObject
 {
-    [Required]
-    public string Key { get; set; }
-    [Required]
-    public KeysRequestModel Keys { get; set; }
-    [Required]
-    public KdfType Kdf { get; set; }
-    [Required]
-    public int KdfIterations { get; set; }
-    public int? KdfMemory { get; set; }
-    public int? KdfParallelism { get; set; }
-    [Required]
-    public string OrgIdentifier { get; set; }
+    // TODO will be removed with https://bitwarden.atlassian.net/browse/PM-27328
+    [Obsolete("Use KeyConnectorKeyWrappedUserKey instead")]
+    public string? Key { get; set; }
 
+    [Obsolete("Use AccountKeys instead")]
+    public KeysRequestModel? Keys { get; set; }
+    [Obsolete("Not used anymore")]
+    public KdfType? Kdf { get; set; }
+    [Obsolete("Not used anymore")]
+    public int? KdfIterations { get; set; }
+    [Obsolete("Not used anymore")]
+    public int? KdfMemory { get; set; }
+    [Obsolete("Not used anymore")]
+    public int? KdfParallelism { get; set; }
+
+    [EncryptedString]
+    public string? KeyConnectorKeyWrappedUserKey { get; set; }
+    public AccountKeysRequestModel? AccountKeys { get; set; }
+
+    [Required]
+    public required string OrgIdentifier { get; init; }
+
+    public IEnumerable<ValidationResult> Validate(ValidationContext validationContext)
+    {
+        if (IsV2Request())
+        {
+            // V2 registration
+            yield break;
+        }
+
+        // V1 registration
+        // TODO removed with https://bitwarden.atlassian.net/browse/PM-27328
+        if (string.IsNullOrEmpty(Key))
+        {
+            yield return new ValidationResult("Key must be supplied.");
+        }
+
+        if (Keys == null)
+        {
+            yield return new ValidationResult("Keys must be supplied.");
+        }
+
+        if (Kdf == null)
+        {
+            yield return new ValidationResult("Kdf must be supplied.");
+        }
+
+        if (KdfIterations == null)
+        {
+            yield return new ValidationResult("KdfIterations must be supplied.");
+        }
+
+        if (Kdf == KdfType.Argon2id)
+        {
+            if (KdfMemory == null)
+            {
+                yield return new ValidationResult("KdfMemory must be supplied when Kdf is Argon2id.");
+            }
+
+            if (KdfParallelism == null)
+            {
+                yield return new ValidationResult("KdfParallelism must be supplied when Kdf is Argon2id.");
+            }
+        }
+    }
+
+    public bool IsV2Request()
+    {
+        return !string.IsNullOrEmpty(KeyConnectorKeyWrappedUserKey) && AccountKeys != null;
+    }
+
+    // TODO removed with https://bitwarden.atlassian.net/browse/PM-27328
     public User ToUser(User existingUser)
     {
-        existingUser.Kdf = Kdf;
-        existingUser.KdfIterations = KdfIterations;
+        existingUser.Kdf = Kdf!.Value;
+        existingUser.KdfIterations = KdfIterations!.Value;
         existingUser.KdfMemory = KdfMemory;
         existingUser.KdfParallelism = KdfParallelism;
         existingUser.Key = Key;
-        Keys.ToUser(existingUser);
+        Keys!.ToUser(existingUser);
         return existingUser;
     }
+
+    public KeyConnectorKeysData ToKeyConnectorKeysData()
+    {
+        // TODO remove validation with https://bitwarden.atlassian.net/browse/PM-27328
+        if (string.IsNullOrEmpty(KeyConnectorKeyWrappedUserKey) || AccountKeys == null)
+        {
+            throw new BadRequestException("KeyConnectorKeyWrappedUserKey and AccountKeys must be supplied.");
+        }
+
+        return new KeyConnectorKeysData
+        {
+            KeyConnectorKeyWrappedUserKey = KeyConnectorKeyWrappedUserKey,
+            AccountKeys = AccountKeys,
+            OrgIdentifier = OrgIdentifier
+        };
+    }
 }

src/Api/Models/Public/Response/CollectionResponseModel.cs

@@ -2,6 +2,7 @@
 #nullable disable
 
 using System.ComponentModel.DataAnnotations;
+using System.Text.Json.Serialization;
 using Bit.Api.AdminConsole.Public.Models.Response;
 using Bit.Core.Entities;
 using Bit.Core.Models.Data;
@@ -13,6 +14,12 @@ namespace Bit.Api.Models.Public.Response;
 /// </summary>
 public class CollectionResponseModel : CollectionBaseModel, IResponseModel
 {
+    [JsonConstructor]
+    public CollectionResponseModel()
+    {
+
+    }
+
     public CollectionResponseModel(Collection collection, IEnumerable<CollectionAccessSelection> groups)
     {
         if (collection == null)

src/Api/Models/Response/KeysResponseModel.cs

@@ -1,27 +1,32 @@
-// FIXME: Update this file to be null safe and then delete the line below
-#nullable disable
-
-using Bit.Core.Entities;
+using Bit.Core.KeyManagement.Models.Api.Response;
+using Bit.Core.KeyManagement.Models.Data;
 using Bit.Core.Models.Api;
 
 namespace Bit.Api.Models.Response;
 
 public class KeysResponseModel : ResponseModel
 {
-    public KeysResponseModel(User user)
+    public KeysResponseModel(UserAccountKeysData accountKeys, string? masterKeyWrappedUserKey)
         : base("keys")
     {
-        if (user == null)
+        if (masterKeyWrappedUserKey != null)
         {
-            throw new ArgumentNullException(nameof(user));
+            Key = masterKeyWrappedUserKey;
         }
 
-        Key = user.Key;
-        PublicKey = user.PublicKey;
-        PrivateKey = user.PrivateKey;
+        PublicKey = accountKeys.PublicKeyEncryptionKeyPairData.PublicKey;
+        PrivateKey = accountKeys.PublicKeyEncryptionKeyPairData.WrappedPrivateKey;
+        AccountKeys = new PrivateKeysResponseModel(accountKeys);
     }
 
-    public string Key { get; set; }
+    /// <summary>
+    /// The master key wrapped user key. The master key can either be a master-password master key or a
+    /// key-connector master key.
+    /// </summary>
+    public string? Key { get; set; }
+    [Obsolete("Use AccountKeys.PublicKeyEncryptionKeyPair.PublicKey instead")]
     public string PublicKey { get; set; }
+    [Obsolete("Use AccountKeys.PublicKeyEncryptionKeyPair.WrappedPrivateKey instead")]
     public string PrivateKey { get; set; }
+    public PrivateKeysResponseModel AccountKeys { get; set; }
 }

src/Api/Public/Controllers/CollectionsController.cs

@@ -65,10 +65,11 @@ public class CollectionsController : Controller
     [ProducesResponseType(typeof(ListResponseModel<CollectionResponseModel>), (int)HttpStatusCode.OK)]
     public async Task<IActionResult> List()
     {
-        var collections = await _collectionRepository.GetManySharedCollectionsByOrganizationIdAsync(
-            _currentContext.OrganizationId.Value);
-        // TODO: Get all CollectionGroup associations for the organization and marry them up here for the response.
-        var collectionResponses = collections.Select(c => new CollectionResponseModel(c, null));
+        var collections = await _collectionRepository.GetManyByOrganizationIdWithAccessAsync(_currentContext.OrganizationId.Value);
+
+        var collectionResponses = collections.Select(c =>
+            new CollectionResponseModel(c.Item1, c.Item2.Groups));
+
         var response = new ListResponseModel<CollectionResponseModel>(collectionResponses);
         return new JsonResult(response);
     }

src/Api/SecretsManager/Controllers/SecretsManagerEventsController.cs

@@ -1,6 +1,7 @@
 // FIXME: Update this file to be null safe and then delete the line below
 #nullable disable
 
+using Bit.Api.Dirt.Models.Response;
 using Bit.Api.Models.Response;
 using Bit.Api.Utilities;
 using Bit.Core.Exceptions;

src/Api/Startup.cs

@@ -187,7 +187,6 @@ public class Startup
         services.AddBillingOperations();
         services.AddReportingServices();
         services.AddImportServices();
-        services.AddPhishingDomainServices(globalSettings);
 
         services.AddSendServices();
 

src/Api/Utilities/DiagnosticTools/EventDiagnosticLogger.cs

@@ -1,4 +1,4 @@
-using Bit.Api.Models.Public.Request;
+using Bit.Api.Dirt.Public.Models;
 using Bit.Api.Models.Public.Response;
 using Bit.Core;
 using Bit.Core.Services;
@@ -49,7 +49,7 @@ public static class EventDiagnosticLogger
         this ILogger logger,
         IFeatureService featureService,
         Guid organizationId,
-        IEnumerable<Bit.Api.Models.Response.EventResponseModel> data,
+        IEnumerable<Dirt.Models.Response.EventResponseModel> data,
         string? continuationToken,
         DateTime? queryStart = null,
         DateTime? queryEnd = null)

src/Api/Utilities/ServiceCollectionExtensions.cs

@@ -1,9 +1,5 @@
 using Bit.Api.AdminConsole.Authorization;
 using Bit.Api.Tools.Authorization;
-using Bit.Core.PhishingDomainFeatures;
-using Bit.Core.PhishingDomainFeatures.Interfaces;
-using Bit.Core.Repositories;
-using Bit.Core.Repositories.Implementations;
 using Bit.Core.Settings;
 using Bit.Core.Utilities;
 using Bit.Core.Vault.Authorization.SecurityTasks;
@@ -103,25 +99,4 @@ public static class ServiceCollectionExtensions
         // Admin Console authorization handlers
         services.AddAdminConsoleAuthorizationHandlers();
     }
-
-    public static void AddPhishingDomainServices(this IServiceCollection services, GlobalSettings globalSettings)
-    {
-        services.AddHttpClient("PhishingDomains", client =>
-        {
-            client.DefaultRequestHeaders.Add("User-Agent", globalSettings.SelfHosted ? "Bitwarden Self-Hosted" : "Bitwarden");
-            client.Timeout = TimeSpan.FromSeconds(1000); // the source list is very slow
-        });
-
-        services.AddSingleton<AzurePhishingDomainStorageService>();
-        services.AddSingleton<IPhishingDomainRepository, AzurePhishingDomainRepository>();
-
-        if (globalSettings.SelfHosted)
-        {
-            services.AddScoped<ICloudPhishingDomainQuery, CloudPhishingDomainRelayQuery>();
-        }
-        else
-        {
-            services.AddScoped<ICloudPhishingDomainQuery, CloudPhishingDomainDirectQuery>();
-        }
-    }
 }

src/Api/appsettings.Development.json

@@ -38,10 +38,6 @@
     "storage": {
       "connectionString": "UseDevelopmentStorage=true"
     },
-    "phishingDomain": {
-      "updateUrl": "https://phish.co.za/latest/phishing-domains-ACTIVE.txt",
-      "checksumUrl": "https://raw.githubusercontent.com/Phishing-Database/checksums/refs/heads/master/phishing-domains-ACTIVE.txt.sha256"
-    },
     "pricingUri": "https://billingpricing.qa.bitwarden.pw"
   }
 }

src/Api/appsettings.json

@@ -69,9 +69,6 @@
       "accessKeySecret": "SECRET",
       "region": "SECRET"
     },
-    "phishingDomain": {
-      "updateUrl": "SECRET"
-    },
     "distributedIpRateLimiting": {
       "enabled": true,
       "maxRedisTimeoutsThreshold": 10,

src/Billing/Billing.csproj

@@ -1,9 +1,17 @@
 <Project Sdk="Microsoft.NET.Sdk.Web">
+  <Sdk Name="Bitwarden.Server.Sdk" />
 
   <PropertyGroup>
     <UserSecretsId>bitwarden-Billing</UserSecretsId>
   </PropertyGroup>
 
+  <PropertyGroup Label="Server SDK settings">
+    <!-- These features will be gradually turned on -->
+    <BitIncludeFeatures>false</BitIncludeFeatures>
+    <BitIncludeTelemetry>false</BitIncludeTelemetry>
+    <BitIncludeAuthentication>false</BitIncludeAuthentication>
+  </PropertyGroup>
+
   <PropertyGroup Condition=" '$(RunConfiguration)' == 'Billing' " />
   <ItemGroup>
     <ProjectReference Include="..\..\bitwarden_license\src\Commercial.Core\Commercial.Core.csproj" />

src/Billing/BillingSettings.cs

@@ -9,10 +9,7 @@ public class BillingSettings
     public virtual string StripeWebhookKey { get; set; }
     public virtual string StripeWebhookSecret20250827Basil { get; set; }
     public virtual string AppleWebhookKey { get; set; }
-    public virtual FreshDeskSettings FreshDesk { get; set; } = new FreshDeskSettings();
-    public virtual string FreshsalesApiKey { get; set; }
     public virtual PayPalSettings PayPal { get; set; } = new PayPalSettings();
-    public virtual OnyxSettings Onyx { get; set; } = new OnyxSettings();
 
     public class PayPalSettings
     {
@@ -21,35 +18,4 @@ public class BillingSettings
         public virtual string WebhookKey { get; set; }
     }
 
-    public class FreshDeskSettings
-    {
-        public virtual string ApiKey { get; set; }
-        public virtual string WebhookKey { get; set; }
-        /// <summary>
-        /// Indicates the data center region. Valid values are "US" and "EU"
-        /// </summary>
-        public virtual string Region { get; set; }
-        public virtual string UserFieldName { get; set; }
-        public virtual string OrgFieldName { get; set; }
-
-        public virtual bool RemoveNewlinesInReplies { get; set; } = false;
-        public virtual string AutoReplyGreeting { get; set; } = string.Empty;
-        public virtual string AutoReplySalutation { get; set; } = string.Empty;
-    }
-
-    public class OnyxSettings
-    {
-        public virtual string ApiKey { get; set; }
-        public virtual string BaseUrl { get; set; }
-        public virtual string Path { get; set; }
-        public virtual int PersonaId { get; set; }
-        public virtual bool UseAnswerWithCitationModels { get; set; } = true;
-
-        public virtual SearchSettings SearchSettings { get; set; } = new SearchSettings();
-    }
-    public class SearchSettings
-    {
-        public virtual string RunSearch { get; set; } = "auto"; // "always", "never", "auto"
-        public virtual bool RealTime { get; set; } = true;
-    }
 }

src/Billing/Controllers/BitPayController.cs

@@ -29,7 +29,7 @@ public class BitPayController(
     IUserRepository userRepository,
     IProviderRepository providerRepository,
     IMailService mailService,
-    IPaymentService paymentService,
+    IStripePaymentService paymentService,
     ILogger<BitPayController> logger,
     IPremiumUserBillingService premiumUserBillingService)
     : Controller

src/Billing/Controllers/FreshdeskController.cs

@@ -1,395 +0,0 @@
-using System.ComponentModel.DataAnnotations;
-using System.Net.Http.Headers;
-using System.Reflection;
-using System.Text;
-using System.Text.Json;
-using System.Web;
-using Bit.Billing.Models;
-using Bit.Core.Repositories;
-using Bit.Core.Settings;
-using Bit.Core.Utilities;
-using Markdig;
-using Microsoft.AspNetCore.Mvc;
-using Microsoft.Extensions.Options;
-
-namespace Bit.Billing.Controllers;
-
-[Route("freshdesk")]
-public class FreshdeskController : Controller
-{
-    private readonly BillingSettings _billingSettings;
-    private readonly IUserRepository _userRepository;
-    private readonly IOrganizationRepository _organizationRepository;
-    private readonly ILogger<FreshdeskController> _logger;
-    private readonly GlobalSettings _globalSettings;
-    private readonly IHttpClientFactory _httpClientFactory;
-
-    public FreshdeskController(
-        IUserRepository userRepository,
-        IOrganizationRepository organizationRepository,
-        IOptions<BillingSettings> billingSettings,
-        ILogger<FreshdeskController> logger,
-        GlobalSettings globalSettings,
-        IHttpClientFactory httpClientFactory)
-    {
-        _billingSettings = billingSettings?.Value ?? throw new ArgumentNullException(nameof(billingSettings));
-        _userRepository = userRepository;
-        _organizationRepository = organizationRepository;
-        _logger = logger;
-        _globalSettings = globalSettings;
-        _httpClientFactory = httpClientFactory;
-    }
-
-    [HttpPost("webhook")]
-    public async Task<IActionResult> PostWebhook([FromQuery, Required] string key,
-        [FromBody, Required] FreshdeskWebhookModel model)
-    {
-        if (string.IsNullOrWhiteSpace(key) || !CoreHelpers.FixedTimeEquals(key, _billingSettings.FreshDesk.WebhookKey))
-        {
-            return new BadRequestResult();
-        }
-
-        try
-        {
-            var ticketId = model.TicketId;
-            var ticketContactEmail = model.TicketContactEmail;
-            var ticketTags = model.TicketTags;
-            if (string.IsNullOrWhiteSpace(ticketId) || string.IsNullOrWhiteSpace(ticketContactEmail))
-            {
-                return new BadRequestResult();
-            }
-
-            var updateBody = new Dictionary<string, object>();
-            var note = string.Empty;
-            note += $"<li>Region: {_billingSettings.FreshDesk.Region}</li>";
-            var customFields = new Dictionary<string, object>();
-            var user = await _userRepository.GetByEmailAsync(ticketContactEmail);
-            if (user == null)
-            {
-                note += $"<li>No user found: {ticketContactEmail}</li>";
-                await CreateNote(ticketId, note);
-            }
-
-            if (user != null)
-            {
-                var userLink = $"{_globalSettings.BaseServiceUri.Admin}/users/edit/{user.Id}";
-                note += $"<li>User, {user.Email}: {userLink}</li>";
-                customFields.Add(_billingSettings.FreshDesk.UserFieldName, userLink);
-                var tags = new HashSet<string>();
-                if (user.Premium)
-                {
-                    tags.Add("Premium");
-                }
-                var orgs = await _organizationRepository.GetManyByUserIdAsync(user.Id);
-
-                foreach (var org in orgs)
-                {
-                    // Prevent org names from injecting any additional HTML
-                    var orgName = HttpUtility.HtmlEncode(org.Name);
-                    var orgNote = $"{orgName} ({org.Seats.GetValueOrDefault()}): " +
-                        $"{_globalSettings.BaseServiceUri.Admin}/organizations/edit/{org.Id}";
-                    note += $"<li>Org, {orgNote}</li>";
-                    if (!customFields.Any(kvp => kvp.Key == _billingSettings.FreshDesk.OrgFieldName))
-                    {
-                        customFields.Add(_billingSettings.FreshDesk.OrgFieldName, orgNote);
-                    }
-                    else
-                    {
-                        customFields[_billingSettings.FreshDesk.OrgFieldName] += $"\n{orgNote}";
-                    }
-
-                    var displayAttribute = GetAttribute<DisplayAttribute>(org.PlanType);
-                    var planName = displayAttribute?.Name?.Split(" ").FirstOrDefault();
-                    if (!string.IsNullOrWhiteSpace(planName))
-                    {
-                        tags.Add(string.Format("Org: {0}", planName));
-                    }
-                }
-                if (tags.Any())
-                {
-                    var tagsToUpdate = tags.ToList();
-                    if (!string.IsNullOrWhiteSpace(ticketTags))
-                    {
-                        var splitTicketTags = ticketTags.Split(',');
-                        for (var i = 0; i < splitTicketTags.Length; i++)
-                        {
-                            tagsToUpdate.Insert(i, splitTicketTags[i]);
-                        }
-                    }
-                    updateBody.Add("tags", tagsToUpdate);
-                }
-
-                if (customFields.Any())
-                {
-                    updateBody.Add("custom_fields", customFields);
-                }
-                var updateRequest = new HttpRequestMessage(HttpMethod.Put,
-                    string.Format("https://bitwarden.freshdesk.com/api/v2/tickets/{0}", ticketId))
-                {
-                    Content = JsonContent.Create(updateBody),
-                };
-                await CallFreshdeskApiAsync(updateRequest);
-                await CreateNote(ticketId, note);
-            }
-
-            return new OkResult();
-        }
-        catch (Exception e)
-        {
-            _logger.LogError(e, "Error processing freshdesk webhook.");
-            return new BadRequestResult();
-        }
-    }
-
-    [HttpPost("webhook-onyx-ai")]
-    public async Task<IActionResult> PostWebhookOnyxAi([FromQuery, Required] string key,
-        [FromBody, Required] FreshdeskOnyxAiWebhookModel model)
-    {
-        // ensure that the key is from Freshdesk
-        if (!IsValidRequestFromFreshdesk(key))
-        {
-            return new BadRequestResult();
-        }
-
-        // if there is no description, then we don't send anything to onyx
-        if (string.IsNullOrEmpty(model.TicketDescriptionText.Trim()))
-        {
-            return Ok();
-        }
-
-        // Get response from Onyx AI
-        var (onyxRequest, onyxResponse) = await GetAnswerFromOnyx(model);
-
-        // the CallOnyxApi will return a null if we have an error response
-        if (onyxResponse?.Answer == null || !string.IsNullOrEmpty(onyxResponse?.ErrorMsg))
-        {
-            _logger.LogWarning("Error getting answer from Onyx AI. Freshdesk model: {model}\r\n Onyx query {query}\r\nresponse: {response}. ",
-                    JsonSerializer.Serialize(model),
-                    JsonSerializer.Serialize(onyxRequest),
-                    JsonSerializer.Serialize(onyxResponse));
-
-            return Ok(); // return ok so we don't retry
-        }
-
-        // add the answer as a note to the ticket
-        await AddAnswerNoteToTicketAsync(onyxResponse?.Answer ?? string.Empty, model.TicketId);
-
-        return Ok();
-    }
-
-    [HttpPost("webhook-onyx-ai-reply")]
-    public async Task<IActionResult> PostWebhookOnyxAiReply([FromQuery, Required] string key,
-        [FromBody, Required] FreshdeskOnyxAiWebhookModel model)
-    {
-        // NOTE:
-        // at this time, this endpoint is a duplicate of `webhook-onyx-ai`
-        // eventually, we will merge both endpoints into one webhook for Freshdesk
-
-        // ensure that the key is from Freshdesk
-        if (!IsValidRequestFromFreshdesk(key) || !ModelState.IsValid)
-        {
-            return new BadRequestResult();
-        }
-
-        // if there is no description, then we don't send anything to onyx
-        if (string.IsNullOrEmpty(model.TicketDescriptionText.Trim()))
-        {
-            return Ok();
-        }
-
-        // create the onyx `answer-with-citation` request
-        var (onyxRequest, onyxResponse) = await GetAnswerFromOnyx(model);
-
-        // the CallOnyxApi will return a null if we have an error response
-        if (onyxResponse?.Answer == null || !string.IsNullOrEmpty(onyxResponse?.ErrorMsg))
-        {
-            _logger.LogWarning("Error getting answer from Onyx AI. Freshdesk model: {model}\r\n Onyx query {query}\r\nresponse: {response}. ",
-                    JsonSerializer.Serialize(model),
-                    JsonSerializer.Serialize(onyxRequest),
-                    JsonSerializer.Serialize(onyxResponse));
-
-            return Ok(); // return ok so we don't retry
-        }
-
-        // add the reply to the ticket
-        await AddReplyToTicketAsync(onyxResponse?.Answer ?? string.Empty, model.TicketId);
-
-        return Ok();
-    }
-
-    private bool IsValidRequestFromFreshdesk(string key)
-    {
-        if (string.IsNullOrWhiteSpace(key)
-                || !CoreHelpers.FixedTimeEquals(key, _billingSettings.FreshDesk.WebhookKey))
-        {
-            return false;
-        }
-
-        return true;
-    }
-
-    private async Task CreateNote(string ticketId, string note)
-    {
-        var noteBody = new Dictionary<string, object>
-                {
-                    { "body", $"<ul>{note}</ul>" },
-                    { "private", true }
-                };
-        var noteRequest = new HttpRequestMessage(HttpMethod.Post,
-            string.Format("https://bitwarden.freshdesk.com/api/v2/tickets/{0}/notes", ticketId))
-        {
-            Content = JsonContent.Create(noteBody),
-        };
-        await CallFreshdeskApiAsync(noteRequest);
-    }
-
-    private async Task AddAnswerNoteToTicketAsync(string note, string ticketId)
-    {
-        // if there is no content, then we don't need to add a note
-        if (string.IsNullOrWhiteSpace(note))
-        {
-            return;
-        }
-
-        var noteBody = new Dictionary<string, object>
-                {
-                    { "body", $"<b>Onyx AI:</b><ul>{note}</ul>" },
-                    { "private", true }
-                };
-
-        var noteRequest = new HttpRequestMessage(HttpMethod.Post,
-                    string.Format("https://bitwarden.freshdesk.com/api/v2/tickets/{0}/notes", ticketId))
-        {
-            Content = JsonContent.Create(noteBody),
-        };
-
-        var addNoteResponse = await CallFreshdeskApiAsync(noteRequest);
-        if (addNoteResponse.StatusCode != System.Net.HttpStatusCode.Created)
-        {
-            _logger.LogError("Error adding note to Freshdesk ticket. Ticket Id: {0}. Status: {1}",
-                            ticketId, addNoteResponse.ToString());
-        }
-    }
-
-    private async Task AddReplyToTicketAsync(string note, string ticketId)
-    {
-        // if there is no content, then we don't need to add a note
-        if (string.IsNullOrWhiteSpace(note))
-        {
-            return;
-        }
-
-        // convert note from markdown to html
-        var htmlNote = note;
-        try
-        {
-            var pipeline = new MarkdownPipelineBuilder().UseAdvancedExtensions().Build();
-            htmlNote = Markdig.Markdown.ToHtml(note, pipeline);
-        }
-        catch (Exception ex)
-        {
-            _logger.LogError(ex, "Error converting markdown to HTML for Freshdesk reply. Ticket Id: {0}. Note: {1}",
-                            ticketId, note);
-            htmlNote = note; // fallback to the original note
-        }
-
-        // clear out any new lines that Freshdesk doesn't like
-        if (_billingSettings.FreshDesk.RemoveNewlinesInReplies)
-        {
-            htmlNote = htmlNote.Replace(Environment.NewLine, string.Empty);
-        }
-
-        var replyBody = new FreshdeskReplyRequestModel
-        {
-            Body = $"{_billingSettings.FreshDesk.AutoReplyGreeting}{htmlNote}{_billingSettings.FreshDesk.AutoReplySalutation}",
-        };
-
-        var replyRequest = new HttpRequestMessage(HttpMethod.Post,
-                    string.Format("https://bitwarden.freshdesk.com/api/v2/tickets/{0}/reply", ticketId))
-        {
-            Content = JsonContent.Create(replyBody),
-        };
-
-        var addReplyResponse = await CallFreshdeskApiAsync(replyRequest);
-        if (addReplyResponse.StatusCode != System.Net.HttpStatusCode.Created)
-        {
-            _logger.LogError("Error adding reply to Freshdesk ticket. Ticket Id: {0}. Status: {1}",
-                            ticketId, addReplyResponse.ToString());
-        }
-    }
-
-    private async Task<HttpResponseMessage> CallFreshdeskApiAsync(HttpRequestMessage request, int retriedCount = 0)
-    {
-        try
-        {
-            var freshdeskAuthkey = Convert.ToBase64String(Encoding.UTF8.GetBytes($"{_billingSettings.FreshDesk.ApiKey}:X"));
-            var httpClient = _httpClientFactory.CreateClient("FreshdeskApi");
-            request.Headers.Add("Authorization", $"Basic {freshdeskAuthkey}");
-            var response = await httpClient.SendAsync(request);
-            if (response.StatusCode != System.Net.HttpStatusCode.TooManyRequests || retriedCount > 3)
-            {
-                return response;
-            }
-        }
-        catch
-        {
-            if (retriedCount > 3)
-            {
-                throw;
-            }
-        }
-        await Task.Delay(30000 * (retriedCount + 1));
-        return await CallFreshdeskApiAsync(request, retriedCount++);
-    }
-
-    async Task<(OnyxRequestModel onyxRequest, OnyxResponseModel onyxResponse)> GetAnswerFromOnyx(FreshdeskOnyxAiWebhookModel model)
-    {
-        // TODO: remove the use of the deprecated answer-with-citation models after we are sure
-        if (_billingSettings.Onyx.UseAnswerWithCitationModels)
-        {
-            var onyxRequest = new OnyxAnswerWithCitationRequestModel(model.TicketDescriptionText, _billingSettings.Onyx);
-            var onyxAnswerWithCitationRequest = new HttpRequestMessage(HttpMethod.Post,
-                                string.Format("{0}/query/answer-with-citation", _billingSettings.Onyx.BaseUrl))
-            {
-                Content = JsonContent.Create(onyxRequest, mediaType: new MediaTypeHeaderValue("application/json")),
-            };
-            var onyxResponse = await CallOnyxApi<OnyxResponseModel>(onyxAnswerWithCitationRequest);
-            return (onyxRequest, onyxResponse);
-        }
-
-        var request = new OnyxSendMessageSimpleApiRequestModel(model.TicketDescriptionText, _billingSettings.Onyx);
-        var onyxSimpleRequest = new HttpRequestMessage(HttpMethod.Post,
-                            string.Format("{0}{1}", _billingSettings.Onyx.BaseUrl, _billingSettings.Onyx.Path))
-        {
-            Content = JsonContent.Create(request, mediaType: new MediaTypeHeaderValue("application/json")),
-        };
-        var onyxSimpleResponse = await CallOnyxApi<OnyxResponseModel>(onyxSimpleRequest);
-        return (request, onyxSimpleResponse);
-    }
-
-    private async Task<T> CallOnyxApi<T>(HttpRequestMessage request) where T : class, new()
-    {
-        var httpClient = _httpClientFactory.CreateClient("OnyxApi");
-        var response = await httpClient.SendAsync(request);
-
-        if (response.StatusCode != System.Net.HttpStatusCode.OK)
-        {
-            _logger.LogError("Error calling Onyx AI API. Status code: {0}. Response {1}",
-                response.StatusCode, JsonSerializer.Serialize(response));
-            return new T();
-        }
-        var responseStr = await response.Content.ReadAsStringAsync();
-        var responseJson = JsonSerializer.Deserialize<T>(responseStr, options: new JsonSerializerOptions
-        {
-            PropertyNameCaseInsensitive = true,
-        });
-
-        return responseJson ?? new T();
-    }
-
-    private TAttribute? GetAttribute<TAttribute>(Enum enumValue) where TAttribute : Attribute
-    {
-        var memberInfo = enumValue.GetType().GetMember(enumValue.ToString()).FirstOrDefault();
-        return memberInfo != null ? memberInfo.GetCustomAttribute<TAttribute>() : null;
-    }
-}

src/Billing/Controllers/FreshsalesController.cs

@@ -1,248 +0,0 @@
-// FIXME: Update this file to be null safe and then delete the line below
-#nullable disable
-
-using System.Net.Http.Headers;
-using System.Text.Json.Serialization;
-using Bit.Core.Billing.Enums;
-using Bit.Core.Repositories;
-using Bit.Core.Settings;
-using Bit.Core.Utilities;
-using Microsoft.AspNetCore.Mvc;
-using Microsoft.Extensions.Options;
-
-namespace Bit.Billing.Controllers;
-
-[Route("freshsales")]
-public class FreshsalesController : Controller
-{
-    private readonly IUserRepository _userRepository;
-    private readonly IOrganizationRepository _organizationRepository;
-    private readonly ILogger _logger;
-    private readonly GlobalSettings _globalSettings;
-
-    private readonly string _freshsalesApiKey;
-
-    private readonly HttpClient _httpClient;
-
-    public FreshsalesController(IUserRepository userRepository,
-        IOrganizationRepository organizationRepository,
-        IOptions<BillingSettings> billingSettings,
-        ILogger<FreshsalesController> logger,
-        GlobalSettings globalSettings)
-    {
-        _userRepository = userRepository;
-        _organizationRepository = organizationRepository;
-        _logger = logger;
-        _globalSettings = globalSettings;
-
-        _httpClient = new HttpClient
-        {
-            BaseAddress = new Uri("https://bitwarden.freshsales.io/api/")
-        };
-
-        _freshsalesApiKey = billingSettings.Value.FreshsalesApiKey;
-
-        _httpClient.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue(
-            "Token",
-            $"token={_freshsalesApiKey}");
-    }
-
-
-    [HttpPost("webhook")]
-    public async Task<IActionResult> PostWebhook([FromHeader(Name = "Authorization")] string key,
-        [FromBody] CustomWebhookRequestModel request,
-        CancellationToken cancellationToken)
-    {
-        if (string.IsNullOrWhiteSpace(key) || !CoreHelpers.FixedTimeEquals(_freshsalesApiKey, key))
-        {
-            return Unauthorized();
-        }
-
-        try
-        {
-            var leadResponse = await _httpClient.GetFromJsonAsync<LeadWrapper<FreshsalesLeadModel>>(
-                    $"leads/{request.LeadId}",
-                    cancellationToken);
-
-            var lead = leadResponse.Lead;
-
-            var primaryEmail = lead.Emails
-                .Where(e => e.IsPrimary)
-                .FirstOrDefault();
-
-            if (primaryEmail == null)
-            {
-                return BadRequest(new { Message = "Lead has not primary email." });
-            }
-
-            var user = await _userRepository.GetByEmailAsync(primaryEmail.Value);
-
-            if (user == null)
-            {
-                return NoContent();
-            }
-
-            var newTags = new HashSet<string>();
-
-            if (user.Premium)
-            {
-                newTags.Add("Premium");
-            }
-
-            var noteItems = new List<string>
-            {
-                $"User, {user.Email}: {_globalSettings.BaseServiceUri.Admin}/users/edit/{user.Id}"
-            };
-
-            var orgs = await _organizationRepository.GetManyByUserIdAsync(user.Id);
-
-            foreach (var org in orgs)
-            {
-                noteItems.Add($"Org, {org.DisplayName()}: {_globalSettings.BaseServiceUri.Admin}/organizations/edit/{org.Id}");
-                if (TryGetPlanName(org.PlanType, out var planName))
-                {
-                    newTags.Add($"Org: {planName}");
-                }
-            }
-
-            if (newTags.Any())
-            {
-                var allTags = newTags.Concat(lead.Tags);
-                var updateLeadResponse = await _httpClient.PutAsJsonAsync(
-                    $"leads/{request.LeadId}",
-                    CreateWrapper(new { tags = allTags }),
-                    cancellationToken);
-                updateLeadResponse.EnsureSuccessStatusCode();
-            }
-
-            var createNoteResponse = await _httpClient.PostAsJsonAsync(
-                "notes",
-                CreateNoteRequestModel(request.LeadId, string.Join('\n', noteItems)), cancellationToken);
-            createNoteResponse.EnsureSuccessStatusCode();
-            return NoContent();
-        }
-        catch (Exception ex)
-        {
-            Console.WriteLine(ex);
-            _logger.LogError(ex, "Error processing freshsales webhook");
-            return BadRequest(new { ex.Message });
-        }
-    }
-
-    private static LeadWrapper<T> CreateWrapper<T>(T lead)
-    {
-        return new LeadWrapper<T>
-        {
-            Lead = lead,
-        };
-    }
-
-    private static CreateNoteRequestModel CreateNoteRequestModel(long leadId, string content)
-    {
-        return new CreateNoteRequestModel
-        {
-            Note = new EditNoteModel
-            {
-                Description = content,
-                TargetableType = "Lead",
-                TargetableId = leadId,
-            },
-        };
-    }
-
-    private static bool TryGetPlanName(PlanType planType, out string planName)
-    {
-        switch (planType)
-        {
-            case PlanType.Free:
-                planName = "Free";
-                return true;
-            case PlanType.FamiliesAnnually:
-            case PlanType.FamiliesAnnually2025:
-            case PlanType.FamiliesAnnually2019:
-                planName = "Families";
-                return true;
-            case PlanType.TeamsAnnually:
-            case PlanType.TeamsAnnually2023:
-            case PlanType.TeamsAnnually2020:
-            case PlanType.TeamsAnnually2019:
-            case PlanType.TeamsMonthly:
-            case PlanType.TeamsMonthly2023:
-            case PlanType.TeamsMonthly2020:
-            case PlanType.TeamsMonthly2019:
-            case PlanType.TeamsStarter:
-            case PlanType.TeamsStarter2023:
-                planName = "Teams";
-                return true;
-            case PlanType.EnterpriseAnnually:
-            case PlanType.EnterpriseAnnually2023:
-            case PlanType.EnterpriseAnnually2020:
-            case PlanType.EnterpriseAnnually2019:
-            case PlanType.EnterpriseMonthly:
-            case PlanType.EnterpriseMonthly2023:
-            case PlanType.EnterpriseMonthly2020:
-            case PlanType.EnterpriseMonthly2019:
-                planName = "Enterprise";
-                return true;
-            case PlanType.Custom:
-                planName = "Custom";
-                return true;
-            default:
-                planName = null;
-                return false;
-        }
-    }
-}
-
-public class CustomWebhookRequestModel
-{
-    [JsonPropertyName("leadId")]
-    public long LeadId { get; set; }
-}
-
-public class LeadWrapper<T>
-{
-    [JsonPropertyName("lead")]
-    public T Lead { get; set; }
-
-    public static LeadWrapper<TItem> Create<TItem>(TItem lead)
-    {
-        return new LeadWrapper<TItem>
-        {
-            Lead = lead,
-        };
-    }
-}
-
-public class FreshsalesLeadModel
-{
-    public string[] Tags { get; set; }
-    public FreshsalesEmailModel[] Emails { get; set; }
-}
-
-public class FreshsalesEmailModel
-{
-    [JsonPropertyName("value")]
-    public string Value { get; set; }
-
-    [JsonPropertyName("is_primary")]
-    public bool IsPrimary { get; set; }
-}
-
-public class CreateNoteRequestModel
-{
-    [JsonPropertyName("note")]
-    public EditNoteModel Note { get; set; }
-}
-
-public class EditNoteModel
-{
-    [JsonPropertyName("description")]
-    public string Description { get; set; }
-
-    [JsonPropertyName("targetable_type")]
-    public string TargetableType { get; set; }
-
-    [JsonPropertyName("targetable_id")]
-    public long TargetableId { get; set; }
-}

src/Billing/Controllers/PayPalController.cs

@@ -23,7 +23,7 @@ public class PayPalController : Controller
     private readonly ILogger<PayPalController> _logger;
     private readonly IMailService _mailService;
     private readonly IOrganizationRepository _organizationRepository;
-    private readonly IPaymentService _paymentService;
+    private readonly IStripePaymentService _paymentService;
     private readonly ITransactionRepository _transactionRepository;
     private readonly IUserRepository _userRepository;
     private readonly IProviderRepository _providerRepository;
@@ -34,7 +34,7 @@ public class PayPalController : Controller
         ILogger<PayPalController> logger,
         IMailService mailService,
         IOrganizationRepository organizationRepository,
-        IPaymentService paymentService,
+        IStripePaymentService paymentService,
         ITransactionRepository transactionRepository,
         IUserRepository userRepository,
         IProviderRepository providerRepository,

src/Billing/Jobs/ReconcileAdditionalStorageJob.cs

@@ -39,15 +39,11 @@ public class ReconcileAdditionalStorageJob(
         logger.LogInformation("Starting ReconcileAdditionalStorageJob (live mode: {LiveMode})", liveMode);
 
         var priceIds = new[] { _storageGbMonthlyPriceId, _storageGbAnnuallyPriceId, _personalStorageGbAnnuallyPriceId };
+        var stripeStatusesToProcess = new[] { StripeConstants.SubscriptionStatus.Active, StripeConstants.SubscriptionStatus.Trialing, StripeConstants.SubscriptionStatus.PastDue };
 
         foreach (var priceId in priceIds)
         {
-            var options = new SubscriptionListOptions
-            {
-                Limit = 100,
-                Status = StripeConstants.SubscriptionStatus.Active,
-                Price = priceId
-            };
+            var options = new SubscriptionListOptions { Limit = 100, Price = priceId };
 
             await foreach (var subscription in stripeFacade.ListSubscriptionsAutoPagingAsync(options))
             {
@@ -64,7 +60,7 @@ public class ReconcileAdditionalStorageJob(
                         failures.Count > 0
                             ? $", Failures: {Environment.NewLine}{string.Join(Environment.NewLine, failures)}"
                             : string.Empty
-                        );
+                    );
                     return;
                 }
 
@@ -73,6 +69,12 @@ public class ReconcileAdditionalStorageJob(
                     continue;
                 }
 
+                if (!stripeStatusesToProcess.Contains(subscription.Status))
+                {
+                    logger.LogInformation("Skipping subscription with unsupported status: {SubscriptionId} - {Status}", subscription.Id, subscription.Status);
+                    continue;
+                }
+
                 logger.LogInformation("Processing subscription: {SubscriptionId}", subscription.Id);
                 subscriptionsFound++;
 
@@ -133,7 +135,7 @@ public class ReconcileAdditionalStorageJob(
             failures.Count > 0
                 ? $", Failures: {Environment.NewLine}{string.Join(Environment.NewLine, failures)}"
                 : string.Empty
-            );
+        );
     }
 
     private SubscriptionUpdateOptions? BuildSubscriptionUpdateOptions(
@@ -145,15 +147,7 @@ public class ReconcileAdditionalStorageJob(
             return null;
         }
 
-        var updateOptions = new SubscriptionUpdateOptions
-        {
-            ProrationBehavior = StripeConstants.ProrationBehavior.CreateProrations,
-            Metadata = new Dictionary<string, string>
-            {
-                [StripeConstants.MetadataKeys.StorageReconciled2025] = DateTime.UtcNow.ToString("o")
-            },
-            Items = []
-        };
+        var updateOptions = new SubscriptionUpdateOptions { ProrationBehavior = StripeConstants.ProrationBehavior.CreateProrations, Metadata = new Dictionary<string, string> { [StripeConstants.MetadataKeys.StorageReconciled2025] = DateTime.UtcNow.ToString("o") }, Items = [] };
 
         var hasUpdates = false;
 
@@ -172,11 +166,7 @@ public class ReconcileAdditionalStorageJob(
                     newQuantity,
                     item.Price.Id);
 
-                updateOptions.Items.Add(new SubscriptionItemOptions
-                {
-                    Id = item.Id,
-                    Quantity = newQuantity
-                });
+                updateOptions.Items.Add(new SubscriptionItemOptions { Id = item.Id, Quantity = newQuantity });
             }
             else
             {
@@ -185,11 +175,7 @@ public class ReconcileAdditionalStorageJob(
                     currentQuantity,
                     item.Price.Id);
 
-                updateOptions.Items.Add(new SubscriptionItemOptions
-                {
-                    Id = item.Id,
-                    Deleted = true
-                });
+                updateOptions.Items.Add(new SubscriptionItemOptions { Id = item.Id, Deleted = true });
             }
         }
 

src/Billing/Models/FreshdeskReplyRequestModel.cs

@@ -1,9 +0,0 @@
-using System.Text.Json.Serialization;
-
-namespace Bit.Billing.Models;
-
-public class FreshdeskReplyRequestModel
-{
-    [JsonPropertyName("body")]
-    public required string Body { get; set; }
-}

src/Billing/Models/FreshdeskWebhookModel.cs

@@ -1,24 +0,0 @@
-// FIXME: Update this file to be null safe and then delete the line below
-#nullable disable
-
-using System.Text.Json.Serialization;
-
-namespace Bit.Billing.Models;
-
-public class FreshdeskWebhookModel
-{
-    [JsonPropertyName("ticket_id")]
-    public string TicketId { get; set; }
-
-    [JsonPropertyName("ticket_contact_email")]
-    public string TicketContactEmail { get; set; }
-
-    [JsonPropertyName("ticket_tags")]
-    public string TicketTags { get; set; }
-}
-
-public class FreshdeskOnyxAiWebhookModel : FreshdeskWebhookModel
-{
-    [JsonPropertyName("ticket_description_text")]
-    public string TicketDescriptionText { get; set; }
-}

src/Billing/Models/OnyxAnswerWithCitationRequestModel.cs

@@ -1,75 +0,0 @@
-using System.Text.Json.Serialization;
-using static Bit.Billing.BillingSettings;
-
-namespace Bit.Billing.Models;
-
-public class OnyxRequestModel
-{
-    [JsonPropertyName("persona_id")]
-    public int PersonaId { get; set; } = 1;
-
-    [JsonPropertyName("retrieval_options")]
-    public RetrievalOptions RetrievalOptions { get; set; } = new RetrievalOptions();
-
-    public OnyxRequestModel(OnyxSettings onyxSettings)
-    {
-        PersonaId = onyxSettings.PersonaId;
-        RetrievalOptions.RunSearch = onyxSettings.SearchSettings.RunSearch;
-        RetrievalOptions.RealTime = onyxSettings.SearchSettings.RealTime;
-    }
-}
-
-/// <summary>
-/// This is used with the onyx endpoint /query/answer-with-citation
-/// which has been deprecated. This can be removed once later
-/// </summary>
-public class OnyxAnswerWithCitationRequestModel : OnyxRequestModel
-{
-    [JsonPropertyName("messages")]
-    public List<Message> Messages { get; set; } = new List<Message>();
-
-    public OnyxAnswerWithCitationRequestModel(string message, OnyxSettings onyxSettings) : base(onyxSettings)
-    {
-        message = message.Replace(Environment.NewLine, " ").Replace('\r', ' ').Replace('\n', ' ');
-        Messages = new List<Message>() { new Message() { MessageText = message } };
-    }
-}
-
-/// <summary>
-/// This is used with the onyx endpoint /chat/send-message-simple-api
-/// </summary>
-public class OnyxSendMessageSimpleApiRequestModel : OnyxRequestModel
-{
-    [JsonPropertyName("message")]
-    public string Message { get; set; } = string.Empty;
-
-    public OnyxSendMessageSimpleApiRequestModel(string message, OnyxSettings onyxSettings) : base(onyxSettings)
-    {
-        Message = message.Replace(Environment.NewLine, " ").Replace('\r', ' ').Replace('\n', ' ');
-    }
-}
-
-public class Message
-{
-    [JsonPropertyName("message")]
-    public string MessageText { get; set; } = string.Empty;
-
-    [JsonPropertyName("sender")]
-    public string Sender { get; set; } = "user";
-}
-
-public class RetrievalOptions
-{
-    [JsonPropertyName("run_search")]
-    public string RunSearch { get; set; } = RetrievalOptionsRunSearch.Auto;
-
-    [JsonPropertyName("real_time")]
-    public bool RealTime { get; set; } = true;
-}
-
-public class RetrievalOptionsRunSearch
-{
-    public const string Always = "always";
-    public const string Never = "never";
-    public const string Auto = "auto";
-}

src/Billing/Models/OnyxResponseModel.cs

@@ -1,15 +0,0 @@
-using System.Text.Json.Serialization;
-
-namespace Bit.Billing.Models;
-
-public class OnyxResponseModel
-{
-    [JsonPropertyName("answer")]
-    public string Answer { get; set; } = string.Empty;
-
-    [JsonPropertyName("answer_citationless")]
-    public string AnswerCitationless { get; set; } = string.Empty;
-
-    [JsonPropertyName("error_msg")]
-    public string ErrorMsg { get; set; } = string.Empty;
-}

src/Billing/Program.cs

@@ -8,6 +8,7 @@ public class Program
     {
         Host
             .CreateDefaultBuilder(args)
+            .UseBitwardenSdk()
             .ConfigureWebHostDefaults(webBuilder =>
             {
                 webBuilder.UseStartup<Startup>();

src/Billing/Services/IStripeEventUtilityService.cs

@@ -36,7 +36,7 @@ public interface IStripeEventUtilityService
     /// <param name="userId"></param>
     /// /// <param name="providerId"></param>
     /// <returns></returns>
-    Transaction FromChargeToTransaction(Charge charge, Guid? organizationId, Guid? userId, Guid? providerId);
+    Task<Transaction> FromChargeToTransactionAsync(Charge charge, Guid? organizationId, Guid? userId, Guid? providerId);
 
     /// <summary>
     /// Attempts to pay the specified invoice. If a customer is eligible, the invoice is paid using Braintree or Stripe.

src/Billing/Services/IStripeFacade.cs

@@ -20,6 +20,12 @@ public interface IStripeFacade
         RequestOptions requestOptions = null,
         CancellationToken cancellationToken = default);
 
+    IAsyncEnumerable<CustomerCashBalanceTransaction> GetCustomerCashBalanceTransactions(
+        string customerId,
+        CustomerCashBalanceTransactionListOptions customerCashBalanceTransactionListOptions = null,
+        RequestOptions requestOptions = null,
+        CancellationToken cancellationToken = default);
+
     Task<Customer> UpdateCustomer(
         string customerId,
         CustomerUpdateOptions customerUpdateOptions = null,

src/Billing/Services/Implementations/ChargeRefundedHandler.cs

@@ -38,7 +38,7 @@ public class ChargeRefundedHandler : IChargeRefundedHandler
         {
             // Attempt to create a transaction for the charge if it doesn't exist
             var (organizationId, userId, providerId) = await _stripeEventUtilityService.GetEntityIdsFromChargeAsync(charge);
-            var tx = _stripeEventUtilityService.FromChargeToTransaction(charge, organizationId, userId, providerId);
+            var tx = await _stripeEventUtilityService.FromChargeToTransactionAsync(charge, organizationId, userId, providerId);
             try
             {
                 parentTransaction = await _transactionRepository.CreateAsync(tx);

src/Billing/Services/Implementations/ChargeSucceededHandler.cs

@@ -46,7 +46,7 @@ public class ChargeSucceededHandler : IChargeSucceededHandler
             return;
         }
 
-        var transaction = _stripeEventUtilityService.FromChargeToTransaction(charge, organizationId, userId, providerId);
+        var transaction = await _stripeEventUtilityService.FromChargeToTransactionAsync(charge, organizationId, userId, providerId);
         if (!transaction.PaymentMethodType.HasValue)
         {
             _logger.LogWarning("Charge success from unsupported source/method. {ChargeId}", charge.Id);

src/Billing/Services/Implementations/SetupIntentSucceededHandler.cs

@@ -2,8 +2,8 @@
 using Bit.Core.AdminConsole.Entities.Provider;
 using Bit.Core.AdminConsole.Repositories;
 using Bit.Core.Billing.Caches;
+using Bit.Core.Billing.Services;
 using Bit.Core.Repositories;
-using Bit.Core.Services;
 using OneOf;
 using Stripe;
 using Event = Stripe.Event;
@@ -59,10 +59,10 @@ public class SetupIntentSucceededHandler(
             return;
         }
 
-        await stripeAdapter.PaymentMethodAttachAsync(paymentMethod.Id,
+        await stripeAdapter.AttachPaymentMethodAsync(paymentMethod.Id,
             new PaymentMethodAttachOptions { Customer = customerId });
 
-        await stripeAdapter.CustomerUpdateAsync(customerId, new CustomerUpdateOptions
+        await stripeAdapter.UpdateCustomerAsync(customerId, new CustomerUpdateOptions
         {
             InvoiceSettings = new CustomerInvoiceSettingsOptions
             {

src/Billing/Services/Implementations/StripeEventUtilityService.cs

@@ -124,7 +124,7 @@ public class StripeEventUtilityService : IStripeEventUtilityService
     /// <param name="userId"></param>
     /// /// <param name="providerId"></param>
     /// <returns></returns>
-    public Transaction FromChargeToTransaction(Charge charge, Guid? organizationId, Guid? userId, Guid? providerId)
+    public async Task<Transaction> FromChargeToTransactionAsync(Charge charge, Guid? organizationId, Guid? userId, Guid? providerId)
     {
         var transaction = new Transaction
         {
@@ -209,6 +209,24 @@ public class StripeEventUtilityService : IStripeEventUtilityService
                         transaction.PaymentMethodType = PaymentMethodType.BankAccount;
                         transaction.Details = $"ACH => {achCreditTransfer.BankName}, {achCreditTransfer.AccountNumber}";
                     }
+                    else if (charge.PaymentMethodDetails.CustomerBalance != null)
+                    {
+                        var bankTransferType = await GetFundingBankTransferTypeAsync(charge);
+
+                        if (!string.IsNullOrEmpty(bankTransferType))
+                        {
+                            transaction.PaymentMethodType = PaymentMethodType.BankAccount;
+                            transaction.Details = bankTransferType switch
+                            {
+                                "eu_bank_transfer" => "EU Bank Transfer",
+                                "gb_bank_transfer" => "GB Bank Transfer",
+                                "jp_bank_transfer" => "JP Bank Transfer",
+                                "mx_bank_transfer" => "MX Bank Transfer",
+                                "us_bank_transfer" => "US Bank Transfer",
+                                _ => "Bank Transfer"
+                            };
+                        }
+                    }
 
                     break;
                 }
@@ -289,20 +307,13 @@ public class StripeEventUtilityService : IStripeEventUtilityService
         }
         var btInvoiceAmount = Math.Round(invoice.AmountDue / 100M, 2);
 
-        var existingTransactions = organizationId.HasValue
-            ? await _transactionRepository.GetManyByOrganizationIdAsync(organizationId.Value)
-            : userId.HasValue
-                ? await _transactionRepository.GetManyByUserIdAsync(userId.Value)
-                : await _transactionRepository.GetManyByProviderIdAsync(providerId.Value);
-
-        var duplicateTimeSpan = TimeSpan.FromHours(24);
-        var now = DateTime.UtcNow;
-        var duplicateTransaction = existingTransactions?
-            .FirstOrDefault(t => (now - t.CreationDate) < duplicateTimeSpan);
-        if (duplicateTransaction != null)
+        // Check if this invoice already has a Braintree transaction ID to prevent duplicate charges
+        if (invoice.Metadata?.ContainsKey("btTransactionId") ?? false)
         {
-            _logger.LogWarning("There is already a recent PayPal transaction ({0}). " +
-                "Do not charge again to prevent possible duplicate.", duplicateTransaction.GatewayId);
+            _logger.LogWarning("Invoice {InvoiceId} already has a Braintree transaction ({TransactionId}). " +
+                "Do not charge again to prevent duplicate.",
+                invoice.Id,
+                invoice.Metadata["btTransactionId"]);
             return false;
         }
 
@@ -413,4 +424,55 @@ public class StripeEventUtilityService : IStripeEventUtilityService
             throw;
         }
     }
+
+    /// <summary>
+    /// Retrieves the bank transfer type that funded a charge paid via customer balance.
+    /// </summary>
+    /// <param name="charge">The charge to analyze.</param>
+    /// <returns>
+    /// The bank transfer type (e.g., "us_bank_transfer", "eu_bank_transfer") if the charge was funded
+    /// by a bank transfer via customer balance, otherwise null.
+    /// </returns>
+    private async Task<string> GetFundingBankTransferTypeAsync(Charge charge)
+    {
+        if (charge is not
+            {
+                CustomerId: not null,
+                PaymentIntentId: not null,
+                PaymentMethodDetails: { Type: "customer_balance" }
+            })
+        {
+            return null;
+        }
+
+        var cashBalanceTransactions = _stripeFacade.GetCustomerCashBalanceTransactions(charge.CustomerId);
+
+        string bankTransferType = null;
+        var matchingPaymentIntentFound = false;
+
+        await foreach (var cashBalanceTransaction in cashBalanceTransactions)
+        {
+            switch (cashBalanceTransaction)
+            {
+                case { Type: "funded", Funded: not null }:
+                    {
+                        bankTransferType = cashBalanceTransaction.Funded.BankTransfer.Type;
+                        break;
+                    }
+                case { Type: "applied_to_payment", AppliedToPayment: not null }
+                    when cashBalanceTransaction.AppliedToPayment.PaymentIntentId == charge.PaymentIntentId:
+                    {
+                        matchingPaymentIntentFound = true;
+                        break;
+                    }
+            }
+
+            if (matchingPaymentIntentFound && !string.IsNullOrEmpty(bankTransferType))
+            {
+                return bankTransferType;
+            }
+        }
+
+        return null;
+    }
 }

src/Billing/Services/Implementations/StripeFacade.cs

@@ -11,6 +11,7 @@ public class StripeFacade : IStripeFacade
 {
     private readonly ChargeService _chargeService = new();
     private readonly CustomerService _customerService = new();
+    private readonly CustomerCashBalanceTransactionService _customerCashBalanceTransactionService = new();
     private readonly EventService _eventService = new();
     private readonly InvoiceService _invoiceService = new();
     private readonly PaymentMethodService _paymentMethodService = new();
@@ -41,6 +42,13 @@ public class StripeFacade : IStripeFacade
         CancellationToken cancellationToken = default) =>
         await _customerService.GetAsync(customerId, customerGetOptions, requestOptions, cancellationToken);
 
+    public IAsyncEnumerable<CustomerCashBalanceTransaction> GetCustomerCashBalanceTransactions(
+        string customerId,
+        CustomerCashBalanceTransactionListOptions customerCashBalanceTransactionListOptions = null,
+        RequestOptions requestOptions = null,
+        CancellationToken cancellationToken = default)
+        => _customerCashBalanceTransactionService.ListAutoPagingAsync(customerId, customerCashBalanceTransactionListOptions, requestOptions, cancellationToken);
+
     public async Task<Customer> UpdateCustomer(
         string customerId,
         CustomerUpdateOptions customerUpdateOptions = null,

src/Billing/Services/Implementations/SubscriptionUpdatedHandler.cs

@@ -109,8 +109,7 @@ public class SubscriptionUpdatedHandler : ISubscriptionUpdatedHandler
                         break;
                     }
 
-                    if (subscription.Status is StripeSubscriptionStatus.Unpaid &&
-                        subscription.Items.Any(i => i.Price.Id is IStripeEventUtilityService.PremiumPlanId or IStripeEventUtilityService.PremiumPlanIdAppStore))
+                    if (await IsPremiumSubscriptionAsync(subscription))
                     {
                         await CancelSubscription(subscription.Id);
                         await VoidOpenInvoices(subscription.Id);
@@ -118,6 +117,20 @@ public class SubscriptionUpdatedHandler : ISubscriptionUpdatedHandler
 
                     await _userService.DisablePremiumAsync(userId.Value, currentPeriodEnd);
 
+                    break;
+                }
+            case StripeSubscriptionStatus.Incomplete when userId.HasValue:
+                {
+                    // Handle Incomplete subscriptions for Premium users that have open invoices from failed payments
+                    // This prevents duplicate subscriptions when users retry the subscription flow
+                    if (await IsPremiumSubscriptionAsync(subscription) &&
+                        subscription.LatestInvoice is { Status: StripeInvoiceStatus.Open })
+                    {
+                        await CancelSubscription(subscription.Id);
+                        await VoidOpenInvoices(subscription.Id);
+                        await _userService.DisablePremiumAsync(userId.Value, currentPeriodEnd);
+                    }
+
                     break;
                 }
             case StripeSubscriptionStatus.Active when organizationId.HasValue:
@@ -190,6 +203,13 @@ public class SubscriptionUpdatedHandler : ISubscriptionUpdatedHandler
         }
     }
 
+    private async Task<bool> IsPremiumSubscriptionAsync(Subscription subscription)
+    {
+        var premiumPlans = await _pricingClient.ListPremiumPlans();
+        var premiumPriceIds = premiumPlans.SelectMany(p => new[] { p.Seat.StripePriceId, p.Storage.StripePriceId }).ToHashSet();
+        return subscription.Items.Any(i => premiumPriceIds.Contains(i.Price.Id));
+    }
+
     /// <summary>
     /// Checks if the provider subscription status has changed from a non-active to an active status type
     /// If the previous status is already active(active,past-due,trialing),canceled,or null, then this will return false.

src/Billing/Startup.cs

@@ -2,7 +2,6 @@
 #nullable disable
 
 using System.Globalization;
-using System.Net.Http.Headers;
 using Bit.Billing.Services;
 using Bit.Billing.Services.Implementations;
 using Bit.Commercial.Core.Utilities;
@@ -98,13 +97,6 @@ public class Startup
         // Authentication
         services.AddAuthentication();
 
-        // Set up HttpClients
-        services.AddHttpClient("FreshdeskApi");
-        services.AddHttpClient("OnyxApi", client =>
-        {
-            client.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", billingSettings.Onyx.ApiKey);
-        });
-
         services.AddScoped<IStripeFacade, StripeFacade>();
         services.AddScoped<IStripeEventService, StripeEventService>();
         services.AddScoped<IProviderEventService, ProviderEventService>();

src/Billing/appsettings.Development.json

@@ -32,10 +32,5 @@
       "connectionString": "UseDevelopmentStorage=true"
     }
   },
-  "billingSettings": {
-    "onyx": {
-      "personaId": 68
-    }
-  },
   "pricingUri": "https://billingpricing.qa.bitwarden.pw"
 }

src/Billing/appsettings.Production.json

@@ -26,10 +26,7 @@
     "payPal": {
       "production": true,
       "businessId": "4ZDA7DLUUJGMN"
-    },
-    "onyx": {
-      "personaId": 7
-    }    
+    }
   },
   "Logging": {
     "IncludeScopes": false,

src/Billing/appsettings.json

@@ -61,27 +61,6 @@
       "production": false,
       "businessId": "AD3LAUZSNVPJY",
       "webhookKey": "SECRET"
-    },
-    "freshdesk": {
-      "apiKey": "SECRET",
-      "webhookKey": "SECRET",
-      "region": "US",
-      "userFieldName": "cf_user",
-      "orgFieldName": "cf_org",
-      "removeNewlinesInReplies": true,
-      "autoReplyGreeting": "<b>Greetings,</b><br /><br />Thank you for contacting Bitwarden. The reply below was generated by our AI agent based on your message:<br /><br />",
-      "autoReplySalutation": "<br /><br />If this response doesn’t fully address your question, simply reply to this email and a member of our Customer Success team will be happy to assist you further.<br /><p><b>Best Regards,</b><br />The Bitwarden Customer Success Team</p>"
-    },
-    "onyx": {
-      "apiKey": "SECRET",
-      "baseUrl": "https://cloud.onyx.app/api",
-      "path": "/chat/send-message-simple-api",
-      "useAnswerWithCitationModels": true,
-      "personaId": 7,
-      "searchSettings": {
-        "runSearch": "always",
-        "realTime": true
-      }
     }
   }
 }

src/Core/AdminConsole/EventIntegrations/EventIntegrationsServiceCollectionExtensions.cs

@@ -1,8 +1,24 @@
-using Bit.Core.AdminConsole.EventIntegrations.OrganizationIntegrations;
+using Azure.Messaging.ServiceBus;
+using Bit.Core.AdminConsole.EventIntegrations.OrganizationIntegrationConfigurations;
+using Bit.Core.AdminConsole.EventIntegrations.OrganizationIntegrationConfigurations.Interfaces;
+using Bit.Core.AdminConsole.EventIntegrations.OrganizationIntegrations;
 using Bit.Core.AdminConsole.EventIntegrations.OrganizationIntegrations.Interfaces;
+using Bit.Core.AdminConsole.Models.Data.EventIntegrations;
+using Bit.Core.AdminConsole.Models.Teams;
+using Bit.Core.AdminConsole.Repositories;
+using Bit.Core.AdminConsole.Services;
+using Bit.Core.AdminConsole.Services.NoopImplementations;
+using Bit.Core.Repositories;
+using Bit.Core.Services;
 using Bit.Core.Settings;
 using Bit.Core.Utilities;
+using Microsoft.Bot.Builder;
+using Microsoft.Bot.Builder.Integration.AspNet.Core;
 using Microsoft.Extensions.DependencyInjection.Extensions;
+using Microsoft.Extensions.Hosting;
+using Microsoft.Extensions.Logging;
+using ZiggyCreatures.Caching.Fusion;
+using TableStorageRepos = Bit.Core.Repositories.TableStorage;
 
 namespace Microsoft.Extensions.DependencyInjection;
 
@@ -20,8 +36,467 @@ public static class EventIntegrationsServiceCollectionExtensions
         // This is idempotent for the same named cache, so it's safe to call.
         services.AddExtendedCache(EventIntegrationsCacheConstants.CacheName, globalSettings);
 
+        // Add Validator
+        services.TryAddSingleton<IOrganizationIntegrationConfigurationValidator, OrganizationIntegrationConfigurationValidator>();
+
         // Add all commands/queries
         services.AddOrganizationIntegrationCommandsQueries();
+        services.AddOrganizationIntegrationConfigurationCommandsQueries();
+
+        return services;
+    }
+
+    /// <summary>
+    /// Registers event write services based on available configuration.
+    /// </summary>
+    /// <param name="services">The service collection to add services to.</param>
+    /// <param name="globalSettings">The global settings containing event logging configuration.</param>
+    /// <returns>The service collection for chaining.</returns>
+    /// <remarks>
+    /// <para>
+    /// This method registers the appropriate IEventWriteService implementation based on the available
+    /// configuration, checking in the following priority order:
+    /// </para>
+    /// <para>
+    /// 1. Azure Service Bus - If all Azure Service Bus settings are present, registers
+    /// EventIntegrationEventWriteService with AzureServiceBusService as the publisher
+    /// </para>
+    /// <para>
+    /// 2. RabbitMQ - If all RabbitMQ settings are present, registers EventIntegrationEventWriteService with
+    /// RabbitMqService as the publisher
+    /// </para>
+    /// <para>
+    /// 3. Azure Queue Storage - If Events.ConnectionString is present, registers AzureQueueEventWriteService
+    /// </para>
+    /// <para>
+    /// 4. Repository (Self-Hosted) - If SelfHosted is true, registers RepositoryEventWriteService
+    /// </para>
+    /// <para>
+    /// 5. Noop - If none of the above are configured, registers NoopEventWriteService (no-op implementation)
+    /// </para>
+    /// </remarks>
+    public static IServiceCollection AddEventWriteServices(this IServiceCollection services, GlobalSettings globalSettings)
+    {
+        if (IsAzureServiceBusEnabled(globalSettings))
+        {
+            services.TryAddSingleton<IEventIntegrationPublisher, AzureServiceBusService>();
+            services.TryAddSingleton<IEventWriteService, EventIntegrationEventWriteService>();
+            return services;
+        }
+
+        if (IsRabbitMqEnabled(globalSettings))
+        {
+            services.TryAddSingleton<IEventIntegrationPublisher, RabbitMqService>();
+            services.TryAddSingleton<IEventWriteService, EventIntegrationEventWriteService>();
+            return services;
+        }
+
+        if (CoreHelpers.SettingHasValue(globalSettings.Events.ConnectionString) &&
+            CoreHelpers.SettingHasValue(globalSettings.Events.QueueName))
+        {
+            services.TryAddSingleton<IEventWriteService, AzureQueueEventWriteService>();
+            return services;
+        }
+
+        if (globalSettings.SelfHosted)
+        {
+            services.TryAddSingleton<IEventWriteService, RepositoryEventWriteService>();
+            return services;
+        }
+
+        services.TryAddSingleton<IEventWriteService, NoopEventWriteService>();
+        return services;
+    }
+
+    /// <summary>
+    /// Registers Azure Service Bus-based event integration listeners and supporting infrastructure.
+    /// </summary>
+    /// <param name="services">The service collection to add services to.</param>
+    /// <param name="globalSettings">The global settings containing Azure Service Bus configuration.</param>
+    /// <returns>The service collection for chaining.</returns>
+    /// <remarks>
+    /// <para>
+    /// If Azure Service Bus is not enabled (missing required settings), this method returns immediately
+    /// without registering any services.
+    /// </para>
+    /// <para>
+    /// When Azure Service Bus is enabled, this method registers:
+    /// - IAzureServiceBusService and IEventIntegrationPublisher implementations
+    /// - Table Storage event repository
+    /// - Azure Table Storage event handler
+    /// - All event integration services via AddEventIntegrationServices
+    /// </para>
+    /// <para>
+    /// PREREQUISITE: Callers must ensure AddDistributedCache has been called before this method,
+    /// as it is required to create the event integrations extended cache.
+    /// </para>
+    /// </remarks>
+    public static IServiceCollection AddAzureServiceBusListeners(this IServiceCollection services, GlobalSettings globalSettings)
+    {
+        if (!IsAzureServiceBusEnabled(globalSettings))
+        {
+            return services;
+        }
+
+        services.TryAddSingleton<IAzureServiceBusService, AzureServiceBusService>();
+        services.TryAddSingleton<IEventIntegrationPublisher, AzureServiceBusService>();
+        services.TryAddSingleton<IEventRepository, TableStorageRepos.EventRepository>();
+        services.TryAddKeyedSingleton<IEventWriteService, RepositoryEventWriteService>("persistent");
+        services.TryAddSingleton<AzureTableStorageEventHandler>();
+
+        services.AddEventIntegrationServices(globalSettings);
+
+        return services;
+    }
+
+    /// <summary>
+    /// Registers RabbitMQ-based event integration listeners and supporting infrastructure.
+    /// </summary>
+    /// <param name="services">The service collection to add services to.</param>
+    /// <param name="globalSettings">The global settings containing RabbitMQ configuration.</param>
+    /// <returns>The service collection for chaining.</returns>
+    /// <remarks>
+    /// <para>
+    /// If RabbitMQ is not enabled (missing required settings), this method returns immediately
+    /// without registering any services.
+    /// </para>
+    /// <para>
+    /// When RabbitMQ is enabled, this method registers:
+    /// - IRabbitMqService and IEventIntegrationPublisher implementations
+    /// - Event repository handler
+    /// - All event integration services via AddEventIntegrationServices
+    /// </para>
+    /// <para>
+    /// PREREQUISITE: Callers must ensure AddDistributedCache has been called before this method,
+    /// as it is required to create the event integrations extended cache.
+    /// </para>
+    /// </remarks>
+    public static IServiceCollection AddRabbitMqListeners(this IServiceCollection services, GlobalSettings globalSettings)
+    {
+        if (!IsRabbitMqEnabled(globalSettings))
+        {
+            return services;
+        }
+
+        services.TryAddSingleton<IRabbitMqService, RabbitMqService>();
+        services.TryAddSingleton<IEventIntegrationPublisher, RabbitMqService>();
+        services.TryAddSingleton<EventRepositoryHandler>();
+
+        services.AddEventIntegrationServices(globalSettings);
+
+        return services;
+    }
+
+    /// <summary>
+    /// Registers Slack integration services based on configuration settings.
+    /// </summary>
+    /// <param name="services">The service collection to add services to.</param>
+    /// <param name="globalSettings">The global settings containing Slack configuration.</param>
+    /// <returns>The service collection for chaining.</returns>
+    /// <remarks>
+    /// If all required Slack settings are configured (ClientId, ClientSecret, Scopes), registers the full SlackService,
+    /// including an HttpClient for Slack API calls. Otherwise, registers a NoopSlackService that performs no operations.
+    /// </remarks>
+    public static IServiceCollection AddSlackService(this IServiceCollection services, GlobalSettings globalSettings)
+    {
+        if (CoreHelpers.SettingHasValue(globalSettings.Slack.ClientId) &&
+            CoreHelpers.SettingHasValue(globalSettings.Slack.ClientSecret) &&
+            CoreHelpers.SettingHasValue(globalSettings.Slack.Scopes))
+        {
+            services.AddHttpClient(SlackService.HttpClientName);
+            services.TryAddSingleton<ISlackService, SlackService>();
+        }
+        else
+        {
+            services.TryAddSingleton<ISlackService, NoopSlackService>();
+        }
+
+        return services;
+    }
+
+    /// <summary>
+    /// Registers Microsoft Teams integration services based on configuration settings.
+    /// </summary>
+    /// <param name="services">The service collection to add services to.</param>
+    /// <param name="globalSettings">The global settings containing Teams configuration.</param>
+    /// <returns>The service collection for chaining.</returns>
+    /// <remarks>
+    /// If all required Teams settings are configured (ClientId, ClientSecret, Scopes), registers:
+    /// - TeamsService and its interfaces (IBot, ITeamsService)
+    /// - IBotFrameworkHttpAdapter with Teams credentials
+    /// - HttpClient for Teams API calls
+    /// Otherwise, registers a NoopTeamsService that performs no operations.
+    /// </remarks>
+    public static IServiceCollection AddTeamsService(this IServiceCollection services, GlobalSettings globalSettings)
+    {
+        if (CoreHelpers.SettingHasValue(globalSettings.Teams.ClientId) &&
+            CoreHelpers.SettingHasValue(globalSettings.Teams.ClientSecret) &&
+            CoreHelpers.SettingHasValue(globalSettings.Teams.Scopes))
+        {
+            services.AddHttpClient(TeamsService.HttpClientName);
+            services.TryAddSingleton<TeamsService>();
+            services.TryAddSingleton<IBot>(sp => sp.GetRequiredService<TeamsService>());
+            services.TryAddSingleton<ITeamsService>(sp => sp.GetRequiredService<TeamsService>());
+            services.TryAddSingleton<IBotFrameworkHttpAdapter>(_ =>
+                new BotFrameworkHttpAdapter(
+                    new TeamsBotCredentialProvider(
+                        clientId: globalSettings.Teams.ClientId,
+                        clientSecret: globalSettings.Teams.ClientSecret
+                    )
+                )
+            );
+        }
+        else
+        {
+            services.TryAddSingleton<ITeamsService, NoopTeamsService>();
+        }
+
+        return services;
+    }
+
+    /// <summary>
+    /// Registers event integration services including handlers, listeners, and supporting infrastructure.
+    /// </summary>
+    /// <param name="services">The service collection to add services to.</param>
+    /// <param name="globalSettings">The global settings containing integration configuration.</param>
+    /// <returns>The service collection for chaining.</returns>
+    /// <remarks>
+    /// <para>
+    /// This method orchestrates the registration of all event integration components based on the enabled
+    /// message broker (Azure Service Bus or RabbitMQ). It is an internal method called by the public
+    /// entry points AddAzureServiceBusListeners and AddRabbitMqListeners.
+    /// </para>
+    /// <para>
+    /// NOTE: If both Azure Service Bus and RabbitMQ are configured, Azure Service Bus takes precedence. This means that
+    /// Azure Service Bus listeners will be registered (and RabbitMQ listeners will NOT) even if this event is called
+    /// from AddRabbitMqListeners when Azure Service Bus settings are configured.
+    /// </para>
+    /// <para>
+    /// PREREQUISITE: Callers must ensure AddDistributedCache has been called before invoking this method.
+    /// This method depends on distributed cache infrastructure being available for the keyed extended
+    /// cache registration.
+    /// </para>
+    /// <para>
+    /// Registered Services:
+    /// - Keyed ExtendedCache for event integrations
+    /// - Integration filter service
+    /// - Integration handlers for Slack, Webhook, Hec, Datadog, and Teams
+    /// - Hosted services for event and integration listeners (based on enabled message broker)
+    /// </para>
+    /// </remarks>
+    internal static IServiceCollection AddEventIntegrationServices(this IServiceCollection services,
+        GlobalSettings globalSettings)
+    {
+        // Add common services
+        // NOTE: AddDistributedCache must be called by the caller before this method
+        services.AddExtendedCache(EventIntegrationsCacheConstants.CacheName, globalSettings);
+        services.TryAddSingleton<IIntegrationFilterService, IntegrationFilterService>();
+        services.TryAddKeyedSingleton<IEventWriteService, RepositoryEventWriteService>("persistent");
+
+        // Add services in support of handlers
+        services.AddSlackService(globalSettings);
+        services.AddTeamsService(globalSettings);
+        services.TryAddSingleton(TimeProvider.System);
+        services.AddHttpClient(WebhookIntegrationHandler.HttpClientName);
+        services.AddHttpClient(DatadogIntegrationHandler.HttpClientName);
+
+        // Add integration handlers
+        services.TryAddSingleton<IIntegrationHandler<SlackIntegrationConfigurationDetails>, SlackIntegrationHandler>();
+        services.TryAddSingleton<IIntegrationHandler<WebhookIntegrationConfigurationDetails>, WebhookIntegrationHandler>();
+        services.TryAddSingleton<IIntegrationHandler<DatadogIntegrationConfigurationDetails>, DatadogIntegrationHandler>();
+        services.TryAddSingleton<IIntegrationHandler<TeamsIntegrationConfigurationDetails>, TeamsIntegrationHandler>();
+
+        var repositoryConfiguration = new RepositoryListenerConfiguration(globalSettings);
+        var slackConfiguration = new SlackListenerConfiguration(globalSettings);
+        var webhookConfiguration = new WebhookListenerConfiguration(globalSettings);
+        var hecConfiguration = new HecListenerConfiguration(globalSettings);
+        var datadogConfiguration = new DatadogListenerConfiguration(globalSettings);
+        var teamsConfiguration = new TeamsListenerConfiguration(globalSettings);
+
+        if (IsAzureServiceBusEnabled(globalSettings))
+        {
+            services.TryAddEnumerable(ServiceDescriptor.Singleton<IHostedService,
+                    AzureServiceBusEventListenerService<RepositoryListenerConfiguration>>(provider =>
+                    new AzureServiceBusEventListenerService<RepositoryListenerConfiguration>(
+                        configuration: repositoryConfiguration,
+                        handler: provider.GetRequiredService<AzureTableStorageEventHandler>(),
+                        serviceBusService: provider.GetRequiredService<IAzureServiceBusService>(),
+                        serviceBusOptions: new ServiceBusProcessorOptions()
+                        {
+                            PrefetchCount = repositoryConfiguration.EventPrefetchCount,
+                            MaxConcurrentCalls = repositoryConfiguration.EventMaxConcurrentCalls
+                        },
+                        loggerFactory: provider.GetRequiredService<ILoggerFactory>()
+                    )
+                )
+            );
+            services.AddAzureServiceBusIntegration<SlackIntegrationConfigurationDetails, SlackListenerConfiguration>(slackConfiguration);
+            services.AddAzureServiceBusIntegration<WebhookIntegrationConfigurationDetails, WebhookListenerConfiguration>(webhookConfiguration);
+            services.AddAzureServiceBusIntegration<WebhookIntegrationConfigurationDetails, HecListenerConfiguration>(hecConfiguration);
+            services.AddAzureServiceBusIntegration<DatadogIntegrationConfigurationDetails, DatadogListenerConfiguration>(datadogConfiguration);
+            services.AddAzureServiceBusIntegration<TeamsIntegrationConfigurationDetails, TeamsListenerConfiguration>(teamsConfiguration);
+
+            return services;
+        }
+
+        if (IsRabbitMqEnabled(globalSettings))
+        {
+            services.TryAddEnumerable(ServiceDescriptor.Singleton<IHostedService,
+                    RabbitMqEventListenerService<RepositoryListenerConfiguration>>(provider =>
+                    new RabbitMqEventListenerService<RepositoryListenerConfiguration>(
+                        handler: provider.GetRequiredService<EventRepositoryHandler>(),
+                        configuration: repositoryConfiguration,
+                        rabbitMqService: provider.GetRequiredService<IRabbitMqService>(),
+                        loggerFactory: provider.GetRequiredService<ILoggerFactory>()
+                    )
+                )
+            );
+            services.AddRabbitMqIntegration<SlackIntegrationConfigurationDetails, SlackListenerConfiguration>(slackConfiguration);
+            services.AddRabbitMqIntegration<WebhookIntegrationConfigurationDetails, WebhookListenerConfiguration>(webhookConfiguration);
+            services.AddRabbitMqIntegration<WebhookIntegrationConfigurationDetails, HecListenerConfiguration>(hecConfiguration);
+            services.AddRabbitMqIntegration<DatadogIntegrationConfigurationDetails, DatadogListenerConfiguration>(datadogConfiguration);
+            services.AddRabbitMqIntegration<TeamsIntegrationConfigurationDetails, TeamsListenerConfiguration>(teamsConfiguration);
+        }
+
+        return services;
+    }
+
+    /// <summary>
+    /// Registers Azure Service Bus-based event integration listeners for a specific integration type.
+    /// </summary>
+    /// <typeparam name="TConfig">The integration configuration details type (e.g., SlackIntegrationConfigurationDetails).</typeparam>
+    /// <typeparam name="TListenerConfig">The listener configuration type implementing IIntegrationListenerConfiguration.</typeparam>
+    /// <param name="services">The service collection to add services to.</param>
+    /// <param name="listenerConfiguration">The listener configuration containing routing keys and message processing settings.</param>
+    /// <returns>The service collection for chaining.</returns>
+    /// <remarks>
+    /// <para>
+    /// This method registers three key components:
+    /// 1. EventIntegrationHandler - Keyed singleton for processing integration events
+    /// 2. AzureServiceBusEventListenerService - Hosted service for listening to event messages from Azure Service Bus
+    ///    for this integration type
+    /// 3. AzureServiceBusIntegrationListenerService - Hosted service for listening to integration messages from
+    ///    Azure Service Bus for this integration type
+    /// </para>
+    /// <para>
+    /// The handler uses the listener configuration's routing key as its service key, allowing multiple
+    /// handlers to be registered for different integration types.
+    /// </para>
+    /// <para>
+    /// Service Bus processor options (PrefetchCount and MaxConcurrentCalls) are configured from the listener
+    /// configuration to optimize message throughput and concurrency.
+    /// </para>
+    /// </remarks>
+    internal static IServiceCollection AddAzureServiceBusIntegration<TConfig, TListenerConfig>(this IServiceCollection services,
+        TListenerConfig listenerConfiguration)
+        where TConfig : class
+        where TListenerConfig : IIntegrationListenerConfiguration
+    {
+        services.TryAddKeyedSingleton<IEventMessageHandler>(serviceKey: listenerConfiguration.RoutingKey, implementationFactory: (provider, _) =>
+            new EventIntegrationHandler<TConfig>(
+                integrationType: listenerConfiguration.IntegrationType,
+                eventIntegrationPublisher: provider.GetRequiredService<IEventIntegrationPublisher>(),
+                integrationFilterService: provider.GetRequiredService<IIntegrationFilterService>(),
+                cache: provider.GetRequiredKeyedService<IFusionCache>(EventIntegrationsCacheConstants.CacheName),
+                configurationRepository: provider.GetRequiredService<IOrganizationIntegrationConfigurationRepository>(),
+                groupRepository: provider.GetRequiredService<IGroupRepository>(),
+                organizationRepository: provider.GetRequiredService<IOrganizationRepository>(),
+                organizationUserRepository: provider.GetRequiredService<IOrganizationUserRepository>(), logger: provider.GetRequiredService<ILogger<EventIntegrationHandler<TConfig>>>())
+        );
+        services.TryAddEnumerable(ServiceDescriptor.Singleton<IHostedService,
+            AzureServiceBusEventListenerService<TListenerConfig>>(provider =>
+                new AzureServiceBusEventListenerService<TListenerConfig>(
+                    configuration: listenerConfiguration,
+                    handler: provider.GetRequiredKeyedService<IEventMessageHandler>(serviceKey: listenerConfiguration.RoutingKey),
+                    serviceBusService: provider.GetRequiredService<IAzureServiceBusService>(),
+                    serviceBusOptions: new ServiceBusProcessorOptions()
+                    {
+                        PrefetchCount = listenerConfiguration.EventPrefetchCount,
+                        MaxConcurrentCalls = listenerConfiguration.EventMaxConcurrentCalls
+                    },
+                    loggerFactory: provider.GetRequiredService<ILoggerFactory>()
+                )
+            )
+        );
+        services.TryAddEnumerable(ServiceDescriptor.Singleton<IHostedService,
+            AzureServiceBusIntegrationListenerService<TListenerConfig>>(provider =>
+                new AzureServiceBusIntegrationListenerService<TListenerConfig>(
+                    configuration: listenerConfiguration,
+                    handler: provider.GetRequiredService<IIntegrationHandler<TConfig>>(),
+                    serviceBusService: provider.GetRequiredService<IAzureServiceBusService>(),
+                    serviceBusOptions: new ServiceBusProcessorOptions()
+                    {
+                        PrefetchCount = listenerConfiguration.IntegrationPrefetchCount,
+                        MaxConcurrentCalls = listenerConfiguration.IntegrationMaxConcurrentCalls
+                    },
+                    loggerFactory: provider.GetRequiredService<ILoggerFactory>()
+                )
+            )
+        );
+
+        return services;
+    }
+
+    /// <summary>
+    /// Registers RabbitMQ-based event integration listeners for a specific integration type.
+    /// </summary>
+    /// <typeparam name="TConfig">The integration configuration details type (e.g., SlackIntegrationConfigurationDetails).</typeparam>
+    /// <typeparam name="TListenerConfig">The listener configuration type implementing IIntegrationListenerConfiguration.</typeparam>
+    /// <param name="services">The service collection to add services to.</param>
+    /// <param name="listenerConfiguration">The listener configuration containing routing keys and message processing settings.</param>
+    /// <returns>The service collection for chaining.</returns>
+    /// <remarks>
+    /// <para>
+    /// This method registers three key components:
+    /// 1. EventIntegrationHandler - Keyed singleton for processing integration events
+    /// 2. RabbitMqEventListenerService - Hosted service for listening to event messages from RabbitMQ for
+    ///    this integration type
+    /// 3. RabbitMqIntegrationListenerService - Hosted service for listening to integration messages from RabbitMQ for
+    ///    this integration type
+    /// </para>
+    ///
+    /// <para>
+    /// The handler uses the listener configuration's routing key as its service key, allowing multiple
+    /// handlers to be registered for different integration types.
+    /// </para>
+    /// </remarks>
+    internal static IServiceCollection AddRabbitMqIntegration<TConfig, TListenerConfig>(this IServiceCollection services,
+        TListenerConfig listenerConfiguration)
+        where TConfig : class
+        where TListenerConfig : IIntegrationListenerConfiguration
+    {
+        services.TryAddKeyedSingleton<IEventMessageHandler>(serviceKey: listenerConfiguration.RoutingKey, implementationFactory: (provider, _) =>
+            new EventIntegrationHandler<TConfig>(
+                integrationType: listenerConfiguration.IntegrationType,
+                eventIntegrationPublisher: provider.GetRequiredService<IEventIntegrationPublisher>(),
+                integrationFilterService: provider.GetRequiredService<IIntegrationFilterService>(),
+                cache: provider.GetRequiredKeyedService<IFusionCache>(EventIntegrationsCacheConstants.CacheName),
+                configurationRepository: provider.GetRequiredService<IOrganizationIntegrationConfigurationRepository>(),
+                groupRepository: provider.GetRequiredService<IGroupRepository>(),
+                organizationRepository: provider.GetRequiredService<IOrganizationRepository>(),
+                organizationUserRepository: provider.GetRequiredService<IOrganizationUserRepository>(), logger: provider.GetRequiredService<ILogger<EventIntegrationHandler<TConfig>>>())
+        );
+        services.TryAddEnumerable(ServiceDescriptor.Singleton<IHostedService,
+            RabbitMqEventListenerService<TListenerConfig>>(provider =>
+                new RabbitMqEventListenerService<TListenerConfig>(
+                    handler: provider.GetRequiredKeyedService<IEventMessageHandler>(serviceKey: listenerConfiguration.RoutingKey),
+                    configuration: listenerConfiguration,
+                    rabbitMqService: provider.GetRequiredService<IRabbitMqService>(),
+                    loggerFactory: provider.GetRequiredService<ILoggerFactory>()
+                )
+            )
+        );
+        services.TryAddEnumerable(ServiceDescriptor.Singleton<IHostedService,
+            RabbitMqIntegrationListenerService<TListenerConfig>>(provider =>
+                new RabbitMqIntegrationListenerService<TListenerConfig>(
+                    handler: provider.GetRequiredService<IIntegrationHandler<TConfig>>(),
+                    configuration: listenerConfiguration,
+                    rabbitMqService: provider.GetRequiredService<IRabbitMqService>(),
+                    loggerFactory: provider.GetRequiredService<ILoggerFactory>(),
+                    timeProvider: provider.GetRequiredService<TimeProvider>()
+                )
+            )
+        );
 
         return services;
     }
@@ -35,4 +510,58 @@ public static class EventIntegrationsServiceCollectionExtensions
 
         return services;
     }
+
+    internal static IServiceCollection AddOrganizationIntegrationConfigurationCommandsQueries(this IServiceCollection services)
+    {
+        services.TryAddScoped<ICreateOrganizationIntegrationConfigurationCommand, CreateOrganizationIntegrationConfigurationCommand>();
+        services.TryAddScoped<IUpdateOrganizationIntegrationConfigurationCommand, UpdateOrganizationIntegrationConfigurationCommand>();
+        services.TryAddScoped<IDeleteOrganizationIntegrationConfigurationCommand, DeleteOrganizationIntegrationConfigurationCommand>();
+        services.TryAddScoped<IGetOrganizationIntegrationConfigurationsQuery, GetOrganizationIntegrationConfigurationsQuery>();
+
+        return services;
+    }
+
+    /// <summary>
+    /// Determines if RabbitMQ is enabled for event integrations based on configuration settings.
+    /// </summary>
+    /// <param name="settings">The global settings containing RabbitMQ configuration.</param>
+    /// <returns>True if all required RabbitMQ settings are present; otherwise, false.</returns>
+    /// <remarks>
+    /// Requires all the following settings to be configured:
+    /// <list type="bullet">
+    ///   <item><description>EventLogging.RabbitMq.HostName</description></item>
+    ///   <item><description>EventLogging.RabbitMq.Username</description></item>
+    ///   <item><description>EventLogging.RabbitMq.Password</description></item>
+    ///   <item><description>EventLogging.RabbitMq.EventExchangeName</description></item>
+    ///   <item><description>EventLogging.RabbitMq.IntegrationExchangeName</description></item>
+    /// </list>
+    /// </remarks>
+    internal static bool IsRabbitMqEnabled(GlobalSettings settings)
+    {
+        return CoreHelpers.SettingHasValue(settings.EventLogging.RabbitMq.HostName) &&
+               CoreHelpers.SettingHasValue(settings.EventLogging.RabbitMq.Username) &&
+               CoreHelpers.SettingHasValue(settings.EventLogging.RabbitMq.Password) &&
+               CoreHelpers.SettingHasValue(settings.EventLogging.RabbitMq.EventExchangeName) &&
+               CoreHelpers.SettingHasValue(settings.EventLogging.RabbitMq.IntegrationExchangeName);
+    }
+
+    /// <summary>
+    /// Determines if Azure Service Bus is enabled for event integrations based on configuration settings.
+    /// </summary>
+    /// <param name="settings">The global settings containing Azure Service Bus configuration.</param>
+    /// <returns>True if all required Azure Service Bus settings are present; otherwise, false.</returns>
+    /// <remarks>
+    /// Requires all of the following settings to be configured:
+    /// <list type="bullet">
+    ///   <item><description>EventLogging.AzureServiceBus.ConnectionString</description></item>
+    ///   <item><description>EventLogging.AzureServiceBus.EventTopicName</description></item>
+    ///   <item><description>EventLogging.AzureServiceBus.IntegrationTopicName</description></item>
+    /// </list>
+    /// </remarks>
+    internal static bool IsAzureServiceBusEnabled(GlobalSettings settings)
+    {
+        return CoreHelpers.SettingHasValue(settings.EventLogging.AzureServiceBus.ConnectionString) &&
+               CoreHelpers.SettingHasValue(settings.EventLogging.AzureServiceBus.EventTopicName) &&
+               CoreHelpers.SettingHasValue(settings.EventLogging.AzureServiceBus.IntegrationTopicName);
+    }
 }

src/Core/AdminConsole/EventIntegrations/OrganizationIntegrationConfigurations/CreateOrganizationIntegrationConfigurationCommand.cs

@@ -0,0 +1,64 @@
+using Bit.Core.AdminConsole.Entities;
+using Bit.Core.AdminConsole.EventIntegrations.OrganizationIntegrationConfigurations.Interfaces;
+using Bit.Core.AdminConsole.Services;
+using Bit.Core.Exceptions;
+using Bit.Core.Repositories;
+using Bit.Core.Utilities;
+using Microsoft.Extensions.DependencyInjection;
+using ZiggyCreatures.Caching.Fusion;
+
+namespace Bit.Core.AdminConsole.EventIntegrations.OrganizationIntegrationConfigurations;
+
+/// <summary>
+/// Command implementation for creating organization integration configurations with validation and cache invalidation support.
+/// </summary>
+public class CreateOrganizationIntegrationConfigurationCommand(
+    IOrganizationIntegrationRepository integrationRepository,
+    IOrganizationIntegrationConfigurationRepository configurationRepository,
+    [FromKeyedServices(EventIntegrationsCacheConstants.CacheName)] IFusionCache cache,
+    IOrganizationIntegrationConfigurationValidator validator)
+    : ICreateOrganizationIntegrationConfigurationCommand
+{
+    public async Task<OrganizationIntegrationConfiguration> CreateAsync(
+        Guid organizationId,
+        Guid integrationId,
+        OrganizationIntegrationConfiguration configuration)
+    {
+        var integration = await integrationRepository.GetByIdAsync(integrationId);
+        if (integration == null || integration.OrganizationId != organizationId)
+        {
+            throw new NotFoundException();
+        }
+        if (!validator.ValidateConfiguration(integration.Type, configuration))
+        {
+            throw new BadRequestException(
+                $"Invalid Configuration and/or Filters for integration type {integration.Type}");
+        }
+
+        var created = await configurationRepository.CreateAsync(configuration);
+
+        // Invalidate the cached configuration details
+        // Even though this is a new record, the cache could hold a stale empty list for this
+        if (created.EventType == null)
+        {
+            // Wildcard configuration - invalidate all cached results for this org/integration
+            await cache.RemoveByTagAsync(
+                EventIntegrationsCacheConstants.BuildCacheTagForOrganizationIntegration(
+                    organizationId: organizationId,
+                    integrationType: integration.Type
+                ));
+        }
+        else
+        {
+            // Specific event type - only invalidate that specific cache entry
+            await cache.RemoveAsync(
+                EventIntegrationsCacheConstants.BuildCacheKeyForOrganizationIntegrationConfigurationDetails(
+                    organizationId: organizationId,
+                    integrationType: integration.Type,
+                    eventType: created.EventType.Value
+                ));
+        }
+
+        return created;
+    }
+}

src/Core/AdminConsole/EventIntegrations/OrganizationIntegrationConfigurations/DeleteOrganizationIntegrationConfigurationCommand.cs

@@ -0,0 +1,54 @@
+using Bit.Core.AdminConsole.EventIntegrations.OrganizationIntegrationConfigurations.Interfaces;
+using Bit.Core.Exceptions;
+using Bit.Core.Repositories;
+using Bit.Core.Utilities;
+using Microsoft.Extensions.DependencyInjection;
+using ZiggyCreatures.Caching.Fusion;
+
+namespace Bit.Core.AdminConsole.EventIntegrations.OrganizationIntegrationConfigurations;
+
+/// <summary>
+/// Command implementation for deleting organization integration configurations with cache invalidation support.
+/// </summary>
+public class DeleteOrganizationIntegrationConfigurationCommand(
+    IOrganizationIntegrationRepository integrationRepository,
+    IOrganizationIntegrationConfigurationRepository configurationRepository,
+    [FromKeyedServices(EventIntegrationsCacheConstants.CacheName)] IFusionCache cache)
+    : IDeleteOrganizationIntegrationConfigurationCommand
+{
+    public async Task DeleteAsync(Guid organizationId, Guid integrationId, Guid configurationId)
+    {
+        var integration = await integrationRepository.GetByIdAsync(integrationId);
+        if (integration == null || integration.OrganizationId != organizationId)
+        {
+            throw new NotFoundException();
+        }
+        var configuration = await configurationRepository.GetByIdAsync(configurationId);
+        if (configuration is null || configuration.OrganizationIntegrationId != integrationId)
+        {
+            throw new NotFoundException();
+        }
+
+        await configurationRepository.DeleteAsync(configuration);
+
+        if (configuration.EventType == null)
+        {
+            // Wildcard configuration - invalidate all cached results for this org/integration
+            await cache.RemoveByTagAsync(
+                EventIntegrationsCacheConstants.BuildCacheTagForOrganizationIntegration(
+                    organizationId: organizationId,
+                    integrationType: integration.Type
+                ));
+        }
+        else
+        {
+            // Specific event type - only invalidate that specific cache entry
+            await cache.RemoveAsync(
+                EventIntegrationsCacheConstants.BuildCacheKeyForOrganizationIntegrationConfigurationDetails(
+                    organizationId: organizationId,
+                    integrationType: integration.Type,
+                    eventType: configuration.EventType.Value
+                ));
+        }
+    }
+}

src/Core/AdminConsole/EventIntegrations/OrganizationIntegrationConfigurations/GetOrganizationIntegrationConfigurationsQuery.cs

@@ -0,0 +1,29 @@
+using Bit.Core.AdminConsole.Entities;
+using Bit.Core.AdminConsole.EventIntegrations.OrganizationIntegrationConfigurations.Interfaces;
+using Bit.Core.Exceptions;
+using Bit.Core.Repositories;
+
+namespace Bit.Core.AdminConsole.EventIntegrations.OrganizationIntegrationConfigurations;
+
+/// <summary>
+/// Query implementation for retrieving organization integration configurations.
+/// </summary>
+public class GetOrganizationIntegrationConfigurationsQuery(
+    IOrganizationIntegrationRepository integrationRepository,
+    IOrganizationIntegrationConfigurationRepository configurationRepository)
+    : IGetOrganizationIntegrationConfigurationsQuery
+{
+    public async Task<List<OrganizationIntegrationConfiguration>> GetManyByIntegrationAsync(
+        Guid organizationId,
+        Guid integrationId)
+    {
+        var integration = await integrationRepository.GetByIdAsync(integrationId);
+        if (integration == null || integration.OrganizationId != organizationId)
+        {
+            throw new NotFoundException();
+        }
+
+        var configurations = await configurationRepository.GetManyByIntegrationAsync(integrationId);
+        return configurations.ToList();
+    }
+}

src/Core/AdminConsole/EventIntegrations/OrganizationIntegrationConfigurations/Interfaces/ICreateOrganizationIntegrationConfigurationCommand.cs

@@ -0,0 +1,22 @@
+using Bit.Core.AdminConsole.Entities;
+
+namespace Bit.Core.AdminConsole.EventIntegrations.OrganizationIntegrationConfigurations.Interfaces;
+
+/// <summary>
+/// Command interface for creating organization integration configurations.
+/// </summary>
+public interface ICreateOrganizationIntegrationConfigurationCommand
+{
+    /// <summary>
+    /// Creates a new configuration for an organization integration.
+    /// </summary>
+    /// <param name="organizationId">The unique identifier of the organization.</param>
+    /// <param name="integrationId">The unique identifier of the integration.</param>
+    /// <param name="configuration">The configuration to create.</param>
+    /// <returns>The created configuration.</returns>
+    /// <exception cref="Exceptions.NotFoundException">Thrown when the integration does not exist
+    /// or does not belong to the specified organization.</exception>
+    /// <exception cref="Exceptions.BadRequestException">Thrown when the configuration or filters
+    /// are invalid for the integration type.</exception>
+    Task<OrganizationIntegrationConfiguration> CreateAsync(Guid organizationId, Guid integrationId, OrganizationIntegrationConfiguration configuration);
+}

src/Core/AdminConsole/EventIntegrations/OrganizationIntegrationConfigurations/Interfaces/IDeleteOrganizationIntegrationConfigurationCommand.cs

@@ -0,0 +1,19 @@
+namespace Bit.Core.AdminConsole.EventIntegrations.OrganizationIntegrationConfigurations.Interfaces;
+
+/// <summary>
+/// Command interface for deleting organization integration configurations.
+/// </summary>
+public interface IDeleteOrganizationIntegrationConfigurationCommand
+{
+    /// <summary>
+    /// Deletes a configuration from an organization integration.
+    /// </summary>
+    /// <param name="organizationId">The unique identifier of the organization.</param>
+    /// <param name="integrationId">The unique identifier of the integration.</param>
+    /// <param name="configurationId">The unique identifier of the configuration to delete.</param>
+    /// <exception cref="Exceptions.NotFoundException">
+    /// Thrown when the integration or configuration does not exist,
+    /// or the integration does not belong to the specified organization,
+    /// or the configuration does not belong to the specified integration.</exception>
+    Task DeleteAsync(Guid organizationId, Guid integrationId, Guid configurationId);
+}

src/Core/AdminConsole/EventIntegrations/OrganizationIntegrationConfigurations/Interfaces/IGetOrganizationIntegrationConfigurationsQuery.cs

@@ -0,0 +1,19 @@
+using Bit.Core.AdminConsole.Entities;
+
+namespace Bit.Core.AdminConsole.EventIntegrations.OrganizationIntegrationConfigurations.Interfaces;
+
+/// <summary>
+/// Query interface for retrieving organization integration configurations.
+/// </summary>
+public interface IGetOrganizationIntegrationConfigurationsQuery
+{
+    /// <summary>
+    /// Retrieves all configurations for a specific organization integration.
+    /// </summary>
+    /// <param name="organizationId">The unique identifier of the organization.</param>
+    /// <param name="integrationId">The unique identifier of the integration.</param>
+    /// <returns>A list of configurations associated with the integration.</returns>
+    /// <exception cref="Exceptions.NotFoundException">Thrown when the integration does not exist
+    /// or does not belong to the specified organization.</exception>
+    Task<List<OrganizationIntegrationConfiguration>> GetManyByIntegrationAsync(Guid organizationId, Guid integrationId);
+}

src/Core/AdminConsole/EventIntegrations/OrganizationIntegrationConfigurations/Interfaces/IUpdateOrganizationIntegrationConfigurationCommand.cs

@@ -0,0 +1,25 @@
+using Bit.Core.AdminConsole.Entities;
+
+namespace Bit.Core.AdminConsole.EventIntegrations.OrganizationIntegrationConfigurations.Interfaces;
+
+/// <summary>
+/// Command interface for updating organization integration configurations.
+/// </summary>
+public interface IUpdateOrganizationIntegrationConfigurationCommand
+{
+    /// <summary>
+    /// Updates an existing configuration for an organization integration.
+    /// </summary>
+    /// <param name="organizationId">The unique identifier of the organization.</param>
+    /// <param name="integrationId">The unique identifier of the integration.</param>
+    /// <param name="configurationId">The unique identifier of the configuration to update.</param>
+    /// <param name="updatedConfiguration">The updated configuration data.</param>
+    /// <returns>The updated configuration.</returns>
+    /// <exception cref="Exceptions.NotFoundException">
+    /// Thrown when the integration or the configuration does not exist,
+    /// or the integration does not belong to the specified organization,
+    /// or the configuration does not belong to the specified integration.</exception>
+    /// <exception cref="Exceptions.BadRequestException">Thrown when the configuration or filters
+    /// are invalid for the integration type.</exception>
+    Task<OrganizationIntegrationConfiguration> UpdateAsync(Guid organizationId, Guid integrationId, Guid configurationId, OrganizationIntegrationConfiguration updatedConfiguration);
+}

src/Core/AdminConsole/EventIntegrations/OrganizationIntegrationConfigurations/UpdateOrganizationIntegrationConfigurationCommand.cs

@@ -0,0 +1,82 @@
+using Bit.Core.AdminConsole.Entities;
+using Bit.Core.AdminConsole.EventIntegrations.OrganizationIntegrationConfigurations.Interfaces;
+using Bit.Core.AdminConsole.Services;
+using Bit.Core.Exceptions;
+using Bit.Core.Repositories;
+using Bit.Core.Utilities;
+using Microsoft.Extensions.DependencyInjection;
+using ZiggyCreatures.Caching.Fusion;
+
+namespace Bit.Core.AdminConsole.EventIntegrations.OrganizationIntegrationConfigurations;
+
+/// <summary>
+/// Command implementation for updating organization integration configurations with validation and cache invalidation support.
+/// </summary>
+public class UpdateOrganizationIntegrationConfigurationCommand(
+    IOrganizationIntegrationRepository integrationRepository,
+    IOrganizationIntegrationConfigurationRepository configurationRepository,
+    [FromKeyedServices(EventIntegrationsCacheConstants.CacheName)] IFusionCache cache,
+    IOrganizationIntegrationConfigurationValidator validator)
+    : IUpdateOrganizationIntegrationConfigurationCommand
+{
+    public async Task<OrganizationIntegrationConfiguration> UpdateAsync(
+        Guid organizationId,
+        Guid integrationId,
+        Guid configurationId,
+        OrganizationIntegrationConfiguration updatedConfiguration)
+    {
+        var integration = await integrationRepository.GetByIdAsync(integrationId);
+        if (integration == null || integration.OrganizationId != organizationId)
+        {
+            throw new NotFoundException();
+        }
+        var configuration = await configurationRepository.GetByIdAsync(configurationId);
+        if (configuration is null || configuration.OrganizationIntegrationId != integrationId)
+        {
+            throw new NotFoundException();
+        }
+        if (!validator.ValidateConfiguration(integration.Type, updatedConfiguration))
+        {
+            throw new BadRequestException($"Invalid Configuration and/or Filters for integration type {integration.Type}");
+        }
+
+        updatedConfiguration.Id = configuration.Id;
+        updatedConfiguration.CreationDate = configuration.CreationDate;
+        await configurationRepository.ReplaceAsync(updatedConfiguration);
+
+        // If either old or new EventType is null (wildcard), invalidate all cached results
+        // for the specific integration
+        if (configuration.EventType == null || updatedConfiguration.EventType == null)
+        {
+            // Wildcard involved - invalidate all cached results for this org/integration
+            await cache.RemoveByTagAsync(
+                EventIntegrationsCacheConstants.BuildCacheTagForOrganizationIntegration(
+                    organizationId: organizationId,
+                    integrationType: integration.Type
+                ));
+
+            return updatedConfiguration;
+        }
+
+        // Both are specific event types - invalidate specific cache entries
+        await cache.RemoveAsync(
+            EventIntegrationsCacheConstants.BuildCacheKeyForOrganizationIntegrationConfigurationDetails(
+                organizationId: organizationId,
+                integrationType: integration.Type,
+                eventType: configuration.EventType.Value
+            ));
+
+        // If event type changed, also clear the new event type's cache
+        if (configuration.EventType != updatedConfiguration.EventType)
+        {
+            await cache.RemoveAsync(
+                EventIntegrationsCacheConstants.BuildCacheKeyForOrganizationIntegrationConfigurationDetails(
+                    organizationId: organizationId,
+                    integrationType: integration.Type,
+                    eventType: updatedConfiguration.EventType.Value
+                ));
+        }
+
+        return updatedConfiguration;
+    }
+}

src/Core/AdminConsole/Models/Data/EventIntegrations/IntegrationFailureCategory.cs

@@ -0,0 +1,37 @@
+namespace Bit.Core.AdminConsole.Models.Data.EventIntegrations;
+
+/// <summary>
+/// Categories of event integration failures used for classification and retry logic.
+/// </summary>
+public enum IntegrationFailureCategory
+{
+    /// <summary>
+    /// Service is temporarily unavailable (503, upstream outage, maintenance).
+    /// </summary>
+    ServiceUnavailable,
+
+    /// <summary>
+    /// Authentication failed (401, 403, invalid_auth, token issues).
+    /// </summary>
+    AuthenticationFailed,
+
+    /// <summary>
+    /// Configuration error (invalid config, channel_not_found, etc.).
+    /// </summary>
+    ConfigurationError,
+
+    /// <summary>
+    /// Rate limited (429, rate_limited).
+    /// </summary>
+    RateLimited,
+
+    /// <summary>
+    /// Transient error (timeouts, 500, network errors).
+    /// </summary>
+    TransientError,
+
+    /// <summary>
+    /// Permanent failure unrelated to authentication/config (e.g., unrecoverable payload/format issue).
+    /// </summary>
+    PermanentFailure
+}

src/Core/AdminConsole/Models/Data/EventIntegrations/IntegrationHandlerResult.cs

@@ -1,16 +1,84 @@
 namespace Bit.Core.AdminConsole.Models.Data.EventIntegrations;
 
+/// <summary>
+/// Represents the result of an integration handler operation, including success status,
+/// failure categorization, and retry metadata. Use the <see cref="Succeed"/> factory method
+/// for successful operations or <see cref="Fail"/> for failures with automatic retry-ability
+/// determination based on the failure category.
+/// </summary>
 public class IntegrationHandlerResult
 {
-    public IntegrationHandlerResult(bool success, IIntegrationMessage message)
+    /// <summary>
+    /// True if the integration send succeeded, false otherwise.
+    /// </summary>
+    public bool Success { get; }
+
+    /// <summary>
+    /// The integration message that was processed.
+    /// </summary>
+    public IIntegrationMessage Message { get; }
+
+    /// <summary>
+    /// Optional UTC date/time indicating when a failed operation should be retried.
+    /// Will be used by the retry queue to delay re-sending the message.
+    /// Usually set based on the Retry-After header from rate-limited responses.
+    /// </summary>
+    public DateTime? DelayUntilDate { get; private init; }
+
+    /// <summary>
+    /// Category of the failure. Null for successful results.
+    /// </summary>
+    public IntegrationFailureCategory? Category { get; private init; }
+
+    /// <summary>
+    /// Detailed failure reason or error message. Empty for successful results.
+    /// </summary>
+    public string? FailureReason { get; private init; }
+
+    /// <summary>
+    /// Indicates whether the operation is retryable.
+    /// Computed from the failure category.
+    /// </summary>
+    public bool Retryable => Category switch
+    {
+        IntegrationFailureCategory.RateLimited => true,
+        IntegrationFailureCategory.TransientError => true,
+        IntegrationFailureCategory.ServiceUnavailable => true,
+        IntegrationFailureCategory.AuthenticationFailed => false,
+        IntegrationFailureCategory.ConfigurationError => false,
+        IntegrationFailureCategory.PermanentFailure => false,
+        null => false,
+        _ => false
+    };
+
+    /// <summary>
+    /// Creates a successful result.
+    /// </summary>
+    public static IntegrationHandlerResult Succeed(IIntegrationMessage message)
+    {
+        return new IntegrationHandlerResult(success: true, message: message);
+    }
+
+    /// <summary>
+    /// Creates a failed result with a failure category and reason.
+    /// </summary>
+    public static IntegrationHandlerResult Fail(
+        IIntegrationMessage message,
+        IntegrationFailureCategory category,
+        string failureReason,
+        DateTime? delayUntil = null)
+    {
+        return new IntegrationHandlerResult(success: false, message: message)
+        {
+            Category = category,
+            FailureReason = failureReason,
+            DelayUntilDate = delayUntil
+        };
+    }
+
+    private IntegrationHandlerResult(bool success, IIntegrationMessage message)
     {
         Success = success;
         Message = message;
     }
-
-    public bool Success { get; set; } = false;
-    public bool Retryable { get; set; } = false;
-    public IIntegrationMessage Message { get; set; }
-    public DateTime? DelayUntilDate { get; set; }
-    public string FailureReason { get; set; } = string.Empty;
 }

src/Core/AdminConsole/Models/Data/Organizations/OrganizationUsers/OrganizationUserUserDetails.cs

@@ -20,6 +20,12 @@ public class OrganizationUserUserDetails : IExternal, ITwoFactorProvidersUser, I
     public string Email { get; set; }
     public string AvatarColor { get; set; }
     public string TwoFactorProviders { get; set; }
+    /// <summary>
+    /// Indicates whether the user has a personal premium subscription.
+    /// Does not include premium access from organizations -
+    /// do not use this to check whether the user can access premium features.
+    /// Null when the organization user is in Invited status (UserId is null).
+    /// </summary>
     public bool? Premium { get; set; }
     public OrganizationUserStatusType Status { get; set; }
     public OrganizationUserType Type { get; set; }

src/Core/AdminConsole/OrganizationFeatures/Import/ImportOrganizationUsersAndGroupsCommand.cs

@@ -2,6 +2,7 @@
 using Bit.Core.AdminConsole.Models.Business;
 using Bit.Core.AdminConsole.OrganizationFeatures.OrganizationUsers.Interfaces;
 using Bit.Core.AdminConsole.Repositories;
+using Bit.Core.Billing.Services;
 using Bit.Core.Entities;
 using Bit.Core.Enums;
 using Bit.Core.Exceptions;
@@ -18,7 +19,7 @@ public class ImportOrganizationUsersAndGroupsCommand : IImportOrganizationUsersA
 {
     private readonly IOrganizationRepository _organizationRepository;
     private readonly IOrganizationUserRepository _organizationUserRepository;
-    private readonly IPaymentService _paymentService;
+    private readonly IStripePaymentService _paymentService;
     private readonly IGroupRepository _groupRepository;
     private readonly IEventService _eventService;
     private readonly IOrganizationService _organizationService;
@@ -27,7 +28,7 @@ public class ImportOrganizationUsersAndGroupsCommand : IImportOrganizationUsersA
 
     public ImportOrganizationUsersAndGroupsCommand(IOrganizationRepository organizationRepository,
             IOrganizationUserRepository organizationUserRepository,
-            IPaymentService paymentService,
+            IStripePaymentService paymentService,
             IGroupRepository groupRepository,
             IEventService eventService,
             IOrganizationService organizationService)

src/Core/AdminConsole/OrganizationFeatures/OrganizationUsers/AcceptOrgUserCommand.cs

@@ -3,6 +3,7 @@
 
 using Bit.Core.AdminConsole.Enums;
 using Bit.Core.AdminConsole.OrganizationFeatures.Policies;
+using Bit.Core.AdminConsole.OrganizationFeatures.Policies.Enforcement.AutoConfirm;
 using Bit.Core.AdminConsole.OrganizationFeatures.Policies.PolicyRequirements;
 using Bit.Core.AdminConsole.Services;
 using Bit.Core.Auth.Models.Business.Tokenables;
@@ -34,6 +35,7 @@ public class AcceptOrgUserCommand : IAcceptOrgUserCommand
     private readonly IDataProtectorTokenFactory<OrgUserInviteTokenable> _orgUserInviteTokenDataFactory;
     private readonly IFeatureService _featureService;
     private readonly IPolicyRequirementQuery _policyRequirementQuery;
+    private readonly IAutomaticUserConfirmationPolicyEnforcementValidator _automaticUserConfirmationPolicyEnforcementValidator;
 
     public AcceptOrgUserCommand(
         IDataProtectionProvider dataProtectionProvider,
@@ -46,7 +48,8 @@ public class AcceptOrgUserCommand : IAcceptOrgUserCommand
         ITwoFactorIsEnabledQuery twoFactorIsEnabledQuery,
         IDataProtectorTokenFactory<OrgUserInviteTokenable> orgUserInviteTokenDataFactory,
         IFeatureService featureService,
-        IPolicyRequirementQuery policyRequirementQuery)
+        IPolicyRequirementQuery policyRequirementQuery,
+        IAutomaticUserConfirmationPolicyEnforcementValidator automaticUserConfirmationPolicyEnforcementValidator)
     {
         // TODO: remove data protector when old token validation removed
         _dataProtector = dataProtectionProvider.CreateProtector(OrgUserInviteTokenable.DataProtectorPurpose);
@@ -60,6 +63,7 @@ public class AcceptOrgUserCommand : IAcceptOrgUserCommand
         _orgUserInviteTokenDataFactory = orgUserInviteTokenDataFactory;
         _featureService = featureService;
         _policyRequirementQuery = policyRequirementQuery;
+        _automaticUserConfirmationPolicyEnforcementValidator = automaticUserConfirmationPolicyEnforcementValidator;
     }
 
     public async Task<OrganizationUser> AcceptOrgUserByEmailTokenAsync(Guid organizationUserId, User user, string emailToken,
@@ -186,13 +190,19 @@ public class AcceptOrgUserCommand : IAcceptOrgUserCommand
             }
         }
 
-        // Enforce Single Organization Policy of organization user is trying to join
         var allOrgUsers = await _organizationUserRepository.GetManyByUserAsync(user.Id);
-        var hasOtherOrgs = allOrgUsers.Any(ou => ou.OrganizationId != orgUser.OrganizationId);
+
+        if (_featureService.IsEnabled(FeatureFlagKeys.AutomaticConfirmUsers))
+        {
+            await ValidateAutomaticUserConfirmationPolicyAsync(orgUser, allOrgUsers, user);
+        }
+
+        // Enforce Single Organization Policy of organization user is trying to join
         var invitedSingleOrgPolicies = await _policyService.GetPoliciesApplicableToUserAsync(user.Id,
             PolicyType.SingleOrg, OrganizationUserStatusType.Invited);
 
-        if (hasOtherOrgs && invitedSingleOrgPolicies.Any(p => p.OrganizationId == orgUser.OrganizationId))
+        if (allOrgUsers.Any(ou => ou.OrganizationId != orgUser.OrganizationId)
+            && invitedSingleOrgPolicies.Any(p => p.OrganizationId == orgUser.OrganizationId))
         {
             throw new BadRequestException("You may not join this organization until you leave or remove all other organizations.");
         }
@@ -255,4 +265,22 @@ public class AcceptOrgUserCommand : IAcceptOrgUserCommand
             }
         }
     }
+
+    private async Task ValidateAutomaticUserConfirmationPolicyAsync(OrganizationUser orgUser,
+        ICollection<OrganizationUser> allOrgUsers, User user)
+    {
+        var error = (await _automaticUserConfirmationPolicyEnforcementValidator.IsCompliantAsync(
+                new AutomaticUserConfirmationPolicyEnforcementRequest(orgUser.OrganizationId,
+                    allOrgUsers.Append(orgUser),
+                    user)))
+            .Match(
+                error => error.Message,
+                _ => string.Empty
+            );
+
+        if (!string.IsNullOrEmpty(error))
+        {
+            throw new BadRequestException(error);
+        }
+    }
 }

src/Core/AdminConsole/OrganizationFeatures/OrganizationUsers/AutoConfirmUser/AutomaticallyConfirmOrganizationUsersValidator.cs

@@ -1,6 +1,7 @@
 using Bit.Core.AdminConsole.Enums;
 using Bit.Core.AdminConsole.OrganizationFeatures.OrganizationUsers.DeleteClaimedAccount;
 using Bit.Core.AdminConsole.OrganizationFeatures.Policies;
+using Bit.Core.AdminConsole.OrganizationFeatures.Policies.Enforcement.AutoConfirm;
 using Bit.Core.AdminConsole.OrganizationFeatures.Policies.PolicyRequirements;
 using Bit.Core.AdminConsole.Repositories;
 using Bit.Core.AdminConsole.Utilities.v2;
@@ -8,6 +9,7 @@ using Bit.Core.AdminConsole.Utilities.v2.Validation;
 using Bit.Core.Auth.UserFeatures.TwoFactorAuth.Interfaces;
 using Bit.Core.Enums;
 using Bit.Core.Repositories;
+using Bit.Core.Services;
 using static Bit.Core.AdminConsole.Utilities.v2.Validation.ValidationResultHelpers;
 
 namespace Bit.Core.AdminConsole.OrganizationFeatures.OrganizationUsers.AutoConfirmUser;
@@ -16,6 +18,8 @@ public class AutomaticallyConfirmOrganizationUsersValidator(
     IOrganizationUserRepository organizationUserRepository,
     ITwoFactorIsEnabledQuery twoFactorIsEnabledQuery,
     IPolicyRequirementQuery policyRequirementQuery,
+    IAutomaticUserConfirmationPolicyEnforcementValidator automaticUserConfirmationPolicyEnforcementValidator,
+    IUserService userService,
     IPolicyRepository policyRepository) : IAutomaticallyConfirmOrganizationUsersValidator
 {
     public async Task<ValidationResult<AutomaticallyConfirmOrganizationUserValidationRequest>> ValidateAsync(
@@ -61,7 +65,7 @@ public class AutomaticallyConfirmOrganizationUsersValidator(
             return Invalid(request, new UserDoesNotHaveTwoFactorEnabled());
         }
 
-        if (await OrganizationUserConformsToSingleOrgPolicyAsync(request) is { } error)
+        if (await OrganizationUserConformsToAutomaticUserConfirmationPolicyAsync(request) is { } error)
         {
             return Invalid(request, error);
         }
@@ -69,10 +73,8 @@ public class AutomaticallyConfirmOrganizationUsersValidator(
         return Valid(request);
     }
 
-    private async Task<bool> OrganizationHasAutomaticallyConfirmUsersPolicyEnabledAsync(
-            AutomaticallyConfirmOrganizationUserValidationRequest request) =>
-        await policyRepository.GetByOrganizationIdTypeAsync(request.OrganizationId,
-            PolicyType.AutomaticUserConfirmation) is { Enabled: true }
+    private async Task<bool> OrganizationHasAutomaticallyConfirmUsersPolicyEnabledAsync(AutomaticallyConfirmOrganizationUserValidationRequest request) =>
+        await policyRepository.GetByOrganizationIdTypeAsync(request.OrganizationId, PolicyType.AutomaticUserConfirmation) is { Enabled: true }
         && request.Organization is { UseAutomaticUserConfirmation: true };
 
     private async Task<bool> OrganizationUserConformsToTwoFactorRequiredPolicyAsync(AutomaticallyConfirmOrganizationUserValidationRequest request)
@@ -87,30 +89,37 @@ public class AutomaticallyConfirmOrganizationUsersValidator(
             .IsTwoFactorRequiredForOrganization(request.Organization!.Id);
     }
 
-    private async Task<Error?> OrganizationUserConformsToSingleOrgPolicyAsync(
+    /// <summary>
+    /// Validates whether the specified organization user complies with the automatic user confirmation policy.
+    /// This includes checks across all organizations the user is associated with to ensure they meet the compliance criteria.
+    ///
+    /// We are not checking single organization policy compliance here because automatically confirm users policy enforces
+    /// a stricter version and applies to all users. If you are compliant with Auto Confirm, you'll be in compliance with
+    /// Single Org.
+    /// </summary>
+    /// <param name="request">
+    /// The request model encapsulates the current organization, the user being validated, and all organization users associated
+    /// with that user.
+    /// </param>
+    /// <returns>
+    /// An <see cref="Error"/> if the user fails to meet the automatic user confirmation policy, or null if the validation succeeds.
+    /// </returns>
+    private async Task<Error?> OrganizationUserConformsToAutomaticUserConfirmationPolicyAsync(
         AutomaticallyConfirmOrganizationUserValidationRequest request)
     {
         var allOrganizationUsersForUser = await organizationUserRepository
             .GetManyByUserAsync(request.OrganizationUser!.UserId!.Value);
 
-        if (allOrganizationUsersForUser.Count == 1)
-        {
-            return null;
-        }
+        var user = await userService.GetUserByIdAsync(request.OrganizationUser!.UserId!.Value);
 
-        var policyRequirement = await policyRequirementQuery
-            .GetAsync<SingleOrganizationPolicyRequirement>(request.OrganizationUser!.UserId!.Value);
-
-        if (policyRequirement.IsSingleOrgEnabledForThisOrganization(request.Organization!.Id))
-        {
-            return new OrganizationEnforcesSingleOrgPolicy();
-        }
-
-        if (policyRequirement.IsSingleOrgEnabledForOrganizationsOtherThan(request.Organization.Id))
-        {
-            return new OtherOrganizationEnforcesSingleOrgPolicy();
-        }
-
-        return null;
+        return (await automaticUserConfirmationPolicyEnforcementValidator.IsCompliantAsync(
+                new AutomaticUserConfirmationPolicyEnforcementRequest(
+                    request.OrganizationId,
+                    allOrganizationUsersForUser,
+                    user)))
+            .Match<Error?>(
+                error => error,
+                _ => null
+            );
     }
 }

src/Core/AdminConsole/OrganizationFeatures/OrganizationUsers/AutoConfirmUser/Errors.cs

@@ -8,6 +8,9 @@ public record UserIsNotUserType() : BadRequestError("Only organization users wit
 public record UserIsNotAccepted() : BadRequestError("Cannot confirm user that has not accepted the invitation.");
 public record OrganizationUserIdIsInvalid() : BadRequestError("Invalid organization user id.");
 public record UserDoesNotHaveTwoFactorEnabled() : BadRequestError("User does not have two-step login enabled.");
-public record OrganizationEnforcesSingleOrgPolicy() : BadRequestError("Cannot confirm this member to the organization until they leave or remove all other organizations");
-public record OtherOrganizationEnforcesSingleOrgPolicy() : BadRequestError("Cannot confirm this member to the organization because they are in another organization which forbids it.");
+public record UserCannotBelongToAnotherOrganization() : BadRequestError("Cannot confirm this member to the organization until they leave or remove all other organizations");
+public record OtherOrganizationDoesNotAllowOtherMembership() : BadRequestError("Cannot confirm this member to the organization because they are in another organization which forbids it.");
 public record AutomaticallyConfirmUsersPolicyIsNotEnabled() : BadRequestError("Cannot confirm this member because the Automatically Confirm Users policy is not enabled.");
+public record ProviderUsersCannotJoin() : BadRequestError("An organization the user is a part of has enabled Automatic User Confirmation policy, and it does not support provider users joining.");
+public record UserCannotJoinProvider() : BadRequestError("An organization the user is a part of has enabled Automatic User Confirmation policy, and it does not support the user joining a provider.");
+public record CurrentOrganizationUserIsNotPresentInRequest() : BadRequestError("The current organization user does not exist in the request.");

src/Core/AdminConsole/OrganizationFeatures/OrganizationUsers/ConfirmOrganizationUserCommand.cs

@@ -4,6 +4,7 @@
 using Bit.Core.AdminConsole.Enums;
 using Bit.Core.AdminConsole.OrganizationFeatures.OrganizationUsers.Interfaces;
 using Bit.Core.AdminConsole.OrganizationFeatures.Policies;
+using Bit.Core.AdminConsole.OrganizationFeatures.Policies.Enforcement.AutoConfirm;
 using Bit.Core.AdminConsole.OrganizationFeatures.Policies.PolicyRequirements;
 using Bit.Core.AdminConsole.Services;
 using Bit.Core.Auth.UserFeatures.TwoFactorAuth.Interfaces;
@@ -33,6 +34,7 @@ public class ConfirmOrganizationUserCommand : IConfirmOrganizationUserCommand
     private readonly IPolicyRequirementQuery _policyRequirementQuery;
     private readonly IFeatureService _featureService;
     private readonly ICollectionRepository _collectionRepository;
+    private readonly IAutomaticUserConfirmationPolicyEnforcementValidator _automaticUserConfirmationPolicyEnforcementValidator;
 
     public ConfirmOrganizationUserCommand(
         IOrganizationRepository organizationRepository,
@@ -47,7 +49,8 @@ public class ConfirmOrganizationUserCommand : IConfirmOrganizationUserCommand
         IDeviceRepository deviceRepository,
         IPolicyRequirementQuery policyRequirementQuery,
         IFeatureService featureService,
-        ICollectionRepository collectionRepository)
+        ICollectionRepository collectionRepository,
+        IAutomaticUserConfirmationPolicyEnforcementValidator automaticUserConfirmationPolicyEnforcementValidator)
     {
         _organizationRepository = organizationRepository;
         _organizationUserRepository = organizationUserRepository;
@@ -62,6 +65,7 @@ public class ConfirmOrganizationUserCommand : IConfirmOrganizationUserCommand
         _policyRequirementQuery = policyRequirementQuery;
         _featureService = featureService;
         _collectionRepository = collectionRepository;
+        _automaticUserConfirmationPolicyEnforcementValidator = automaticUserConfirmationPolicyEnforcementValidator;
     }
 
     public async Task<OrganizationUser> ConfirmUserAsync(Guid organizationId, Guid organizationUserId, string key,
@@ -127,6 +131,7 @@ public class ConfirmOrganizationUserCommand : IConfirmOrganizationUserCommand
 
         var organization = await _organizationRepository.GetByIdAsync(organizationId);
         var allUsersOrgs = await _organizationUserRepository.GetManyByManyUsersAsync(validSelectedUserIds);
+
         var users = await _userRepository.GetManyAsync(validSelectedUserIds);
         var usersTwoFactorEnabled = await _twoFactorIsEnabledQuery.TwoFactorIsEnabledAsync(validSelectedUserIds);
 
@@ -188,6 +193,25 @@ public class ConfirmOrganizationUserCommand : IConfirmOrganizationUserCommand
         await ValidateTwoFactorAuthenticationPolicyAsync(user, organizationId, userTwoFactorEnabled);
 
         var hasOtherOrgs = userOrgs.Any(ou => ou.OrganizationId != organizationId);
+
+        if (_featureService.IsEnabled(FeatureFlagKeys.AutomaticConfirmUsers))
+        {
+            var error = (await _automaticUserConfirmationPolicyEnforcementValidator.IsCompliantAsync(
+                    new AutomaticUserConfirmationPolicyEnforcementRequest(
+                        organizationId,
+                        userOrgs,
+                        user)))
+                .Match(
+                    error => new BadRequestException(error.Message),
+                    _ => null
+                );
+
+            if (error is not null)
+            {
+                throw error;
+            }
+        }
+
         var singleOrgPolicies = await _policyService.GetPoliciesApplicableToUserAsync(user.Id, PolicyType.SingleOrg);
         var otherSingleOrgPolicies =
             singleOrgPolicies.Where(p => p.OrganizationId != organizationId);
@@ -267,8 +291,7 @@ public class ConfirmOrganizationUserCommand : IConfirmOrganizationUserCommand
             return;
         }
 
-        var organizationDataOwnershipPolicy =
-            await _policyRequirementQuery.GetAsync<OrganizationDataOwnershipPolicyRequirement>(organizationUser.UserId!.Value);
+        var organizationDataOwnershipPolicy = await _policyRequirementQuery.GetAsync<OrganizationDataOwnershipPolicyRequirement>(organizationUser.UserId!.Value);
         if (!organizationDataOwnershipPolicy.RequiresDefaultCollectionOnConfirm(organizationUser.OrganizationId))
         {
             return;
@@ -311,8 +334,8 @@ public class ConfirmOrganizationUserCommand : IConfirmOrganizationUserCommand
             return;
         }
 
-        var policyEligibleOrganizationUserIds =
-            await _policyRequirementQuery.GetManyByOrganizationIdAsync<OrganizationDataOwnershipPolicyRequirement>(organizationId);
+        var policyEligibleOrganizationUserIds = await _policyRequirementQuery
+            .GetManyByOrganizationIdAsync<OrganizationDataOwnershipPolicyRequirement>(organizationId);
 
         var eligibleOrganizationUserIds = confirmedOrganizationUsers
             .Where(ou => policyEligibleOrganizationUserIds.Contains(ou.Id))

src/Core/AdminConsole/OrganizationFeatures/OrganizationUsers/InviteUsers/Validation/InviteOrganizationUserValidator.cs

@@ -2,10 +2,10 @@
 using Bit.Core.AdminConsole.OrganizationFeatures.OrganizationUsers.InviteUsers.Validation.PasswordManager;
 using Bit.Core.AdminConsole.Utilities.Errors;
 using Bit.Core.AdminConsole.Utilities.Validation;
+using Bit.Core.Billing.Services;
 using Bit.Core.Models.Business;
 using Bit.Core.OrganizationFeatures.OrganizationSubscriptions.Interface;
 using Bit.Core.Repositories;
-using Bit.Core.Services;
 
 namespace Bit.Core.AdminConsole.OrganizationFeatures.OrganizationUsers.InviteUsers.Validation;
 
@@ -15,7 +15,7 @@ public class InviteOrganizationUsersValidator(
     IOrganizationRepository organizationRepository,
     IInviteUsersPasswordManagerValidator inviteUsersPasswordManagerValidator,
     IUpdateSecretsManagerSubscriptionCommand secretsManagerSubscriptionCommand,
-    IPaymentService paymentService) : IInviteUsersValidator
+    IStripePaymentService paymentService) : IInviteUsersValidator
 {
     public async Task<ValidationResult<InviteOrganizationUsersValidationRequest>> ValidateAsync(
         InviteOrganizationUsersValidationRequest request)

src/Core/AdminConsole/OrganizationFeatures/OrganizationUsers/InviteUsers/Validation/PasswordManager/InviteUsersPasswordManagerValidator.cs

@@ -9,8 +9,8 @@ using Bit.Core.AdminConsole.OrganizationFeatures.OrganizationUsers.InviteUsers.V
 using Bit.Core.AdminConsole.OrganizationFeatures.OrganizationUsers.InviteUsers.Validation.Provider;
 using Bit.Core.AdminConsole.Repositories;
 using Bit.Core.AdminConsole.Utilities.Validation;
+using Bit.Core.Billing.Services;
 using Bit.Core.Repositories;
-using Bit.Core.Services;
 using Bit.Core.Settings;
 
 namespace Bit.Core.AdminConsole.OrganizationFeatures.OrganizationUsers.InviteUsers.Validation.PasswordManager;
@@ -22,7 +22,7 @@ public class InviteUsersPasswordManagerValidator(
     IInviteUsersEnvironmentValidator inviteUsersEnvironmentValidator,
     IInviteUsersOrganizationValidator inviteUsersOrganizationValidator,
     IProviderRepository providerRepository,
-    IPaymentService paymentService,
+    IStripePaymentService paymentService,
     IOrganizationRepository organizationRepository
     ) : IInviteUsersPasswordManagerValidator
 {

src/Core/AdminConsole/OrganizationFeatures/OrganizationUsers/RestoreUser/v1/RestoreOrganizationUserCommand.cs

@@ -4,6 +4,7 @@
 using Bit.Core.AdminConsole.Entities;
 using Bit.Core.AdminConsole.Enums;
 using Bit.Core.AdminConsole.OrganizationFeatures.Policies;
+using Bit.Core.AdminConsole.OrganizationFeatures.Policies.Enforcement.AutoConfirm;
 using Bit.Core.AdminConsole.OrganizationFeatures.Policies.PolicyRequirements;
 using Bit.Core.AdminConsole.Services;
 using Bit.Core.Auth.UserFeatures.TwoFactorAuth.Interfaces;
@@ -29,7 +30,8 @@ public class RestoreOrganizationUserCommand(
     IUserRepository userRepository,
     IOrganizationService organizationService,
     IFeatureService featureService,
-    IPolicyRequirementQuery policyRequirementQuery) : IRestoreOrganizationUserCommand
+    IPolicyRequirementQuery policyRequirementQuery,
+    IAutomaticUserConfirmationPolicyEnforcementValidator automaticUserConfirmationPolicyEnforcementValidator) : IRestoreOrganizationUserCommand
 {
     public async Task RestoreUserAsync(OrganizationUser organizationUser, Guid? restoringUserId)
     {
@@ -300,6 +302,25 @@ public class RestoreOrganizationUserCommand(
         {
             throw new BadRequestException(user.Email + " is not compliant with the two-step login policy");
         }
+
+        if (featureService.IsEnabled(FeatureFlagKeys.AutomaticConfirmUsers))
+        {
+            var validationResult = await automaticUserConfirmationPolicyEnforcementValidator.IsCompliantAsync(
+                new AutomaticUserConfirmationPolicyEnforcementRequest(orgUser.OrganizationId,
+                    allOrgUsers,
+                    user!));
+
+            var badRequestException = validationResult.Match(
+                error => new BadRequestException(user.Email +
+                                                 " is not compliant with the automatic user confirmation policy: " +
+                                                 error.Message),
+                _ => null);
+
+            if (badRequestException is not null)
+            {
+                throw badRequestException;
+            }
+        }
     }
 
     private async Task<bool> IsTwoFactorRequiredForOrganizationAsync(Guid userId, Guid organizationId)

src/Core/AdminConsole/OrganizationFeatures/Organizations/CloudOrganizationSignUpCommand.cs

@@ -3,11 +3,14 @@
 
 using Bit.Core.AdminConsole.Entities;
 using Bit.Core.AdminConsole.Enums;
+using Bit.Core.AdminConsole.OrganizationFeatures.Policies;
+using Bit.Core.AdminConsole.OrganizationFeatures.Policies.PolicyRequirements;
 using Bit.Core.AdminConsole.Services;
 using Bit.Core.Billing.Enums;
 using Bit.Core.Billing.Organizations.Models;
 using Bit.Core.Billing.Organizations.Services;
 using Bit.Core.Billing.Pricing;
+using Bit.Core.Billing.Services;
 using Bit.Core.Entities;
 using Bit.Core.Enums;
 using Bit.Core.Exceptions;
@@ -33,7 +36,7 @@ public interface ICloudOrganizationSignUpCommand
 public class CloudOrganizationSignUpCommand(
     IOrganizationUserRepository organizationUserRepository,
     IOrganizationBillingService organizationBillingService,
-    IPaymentService paymentService,
+    IStripePaymentService paymentService,
     IPolicyService policyService,
     IOrganizationRepository organizationRepository,
     IOrganizationApiKeyRepository organizationApiKeyRepository,
@@ -42,7 +45,9 @@ public class CloudOrganizationSignUpCommand(
     IPushNotificationService pushNotificationService,
     ICollectionRepository collectionRepository,
     IDeviceRepository deviceRepository,
-    IPricingClient pricingClient) : ICloudOrganizationSignUpCommand
+    IPricingClient pricingClient,
+    IPolicyRequirementQuery policyRequirementQuery,
+    IFeatureService featureService) : ICloudOrganizationSignUpCommand
 {
     public async Task<SignUpOrganizationResponse> SignUpOrganizationAsync(OrganizationSignup signup)
     {
@@ -236,6 +241,17 @@ public class CloudOrganizationSignUpCommand(
 
     private async Task ValidateSignUpPoliciesAsync(Guid ownerId)
     {
+        if (featureService.IsEnabled(FeatureFlagKeys.AutomaticConfirmUsers))
+        {
+            var requirement = await policyRequirementQuery.GetAsync<AutomaticUserConfirmationPolicyRequirement>(ownerId);
+
+            if (requirement.CannotCreateNewOrganization())
+            {
+                throw new BadRequestException("You may not create an organization. You belong to an organization " +
+                                              "which has a policy that prohibits you from being a member of any other organization.");
+            }
+        }
+
         var anySingleOrgPolicies = await policyService.AnyPoliciesApplicableToUserAsync(ownerId, PolicyType.SingleOrg);
         if (anySingleOrgPolicies)
         {

src/Core/AdminConsole/OrganizationFeatures/Organizations/InitPendingOrganizationCommand.cs

@@ -2,6 +2,8 @@
 #nullable disable
 
 using Bit.Core.AdminConsole.Enums;
+using Bit.Core.AdminConsole.OrganizationFeatures.Policies;
+using Bit.Core.AdminConsole.OrganizationFeatures.Policies.PolicyRequirements;
 using Bit.Core.AdminConsole.Services;
 using Bit.Core.Auth.Models.Business.Tokenables;
 using Bit.Core.Entities;
@@ -28,6 +30,8 @@ public class InitPendingOrganizationCommand : IInitPendingOrganizationCommand
     private readonly IGlobalSettings _globalSettings;
     private readonly IPolicyService _policyService;
     private readonly IOrganizationUserRepository _organizationUserRepository;
+    private readonly IFeatureService _featureService;
+    private readonly IPolicyRequirementQuery _policyRequirementQuery;
 
     public InitPendingOrganizationCommand(
             IOrganizationService organizationService,
@@ -37,7 +41,9 @@ public class InitPendingOrganizationCommand : IInitPendingOrganizationCommand
             IDataProtectionProvider dataProtectionProvider,
             IGlobalSettings globalSettings,
             IPolicyService policyService,
-            IOrganizationUserRepository organizationUserRepository
+            IOrganizationUserRepository organizationUserRepository,
+            IFeatureService featureService,
+            IPolicyRequirementQuery policyRequirementQuery
             )
     {
         _organizationService = organizationService;
@@ -48,6 +54,8 @@ public class InitPendingOrganizationCommand : IInitPendingOrganizationCommand
         _globalSettings = globalSettings;
         _policyService = policyService;
         _organizationUserRepository = organizationUserRepository;
+        _featureService = featureService;
+        _policyRequirementQuery = policyRequirementQuery;
     }
 
     public async Task InitPendingOrganizationAsync(User user, Guid organizationId, Guid organizationUserId, string publicKey, string privateKey, string collectionName, string emailToken)
@@ -113,6 +121,17 @@ public class InitPendingOrganizationCommand : IInitPendingOrganizationCommand
 
     private async Task ValidateSignUpPoliciesAsync(Guid ownerId)
     {
+        if (_featureService.IsEnabled(FeatureFlagKeys.AutomaticConfirmUsers))
+        {
+            var requirement = await _policyRequirementQuery.GetAsync<AutomaticUserConfirmationPolicyRequirement>(ownerId);
+
+            if (requirement.CannotCreateNewOrganization())
+            {
+                throw new BadRequestException("You may not create an organization. You belong to an organization " +
+                                              "which has a policy that prohibits you from being a member of any other organization.");
+            }
+        }
+
         var anySingleOrgPolicies = await _policyService.AnyPoliciesApplicableToUserAsync(ownerId, PolicyType.SingleOrg);
         if (anySingleOrgPolicies)
         {

src/Core/AdminConsole/OrganizationFeatures/Organizations/OrganizationDeleteCommand.cs

@@ -2,6 +2,7 @@
 using Bit.Core.AdminConsole.OrganizationFeatures.Organizations.Interfaces;
 using Bit.Core.Auth.Enums;
 using Bit.Core.Auth.Repositories;
+using Bit.Core.Billing.Services;
 using Bit.Core.Exceptions;
 using Bit.Core.Repositories;
 using Bit.Core.Services;
@@ -12,13 +13,13 @@ public class OrganizationDeleteCommand : IOrganizationDeleteCommand
 {
     private readonly IApplicationCacheService _applicationCacheService;
     private readonly IOrganizationRepository _organizationRepository;
-    private readonly IPaymentService _paymentService;
+    private readonly IStripePaymentService _paymentService;
     private readonly ISsoConfigRepository _ssoConfigRepository;
 
     public OrganizationDeleteCommand(
         IApplicationCacheService applicationCacheService,
         IOrganizationRepository organizationRepository,
-        IPaymentService paymentService,
+        IStripePaymentService paymentService,
         ISsoConfigRepository ssoConfigRepository)
     {
         _applicationCacheService = applicationCacheService;

src/Core/AdminConsole/OrganizationFeatures/Organizations/ResellerClientOrganizationSignUpCommand.cs

@@ -1,6 +1,7 @@
 using Bit.Core.AdminConsole.Entities;
 using Bit.Core.AdminConsole.OrganizationFeatures.OrganizationUsers.InviteUsers;
 using Bit.Core.AdminConsole.OrganizationFeatures.OrganizationUsers.InviteUsers.Models;
+using Bit.Core.Billing.Services;
 using Bit.Core.Entities;
 using Bit.Core.Enums;
 using Bit.Core.Repositories;
@@ -39,7 +40,7 @@ public class ResellerClientOrganizationSignUpCommand : IResellerClientOrganizati
     private readonly IOrganizationUserRepository _organizationUserRepository;
     private readonly IEventService _eventService;
     private readonly ISendOrganizationInvitesCommand _sendOrganizationInvitesCommand;
-    private readonly IPaymentService _paymentService;
+    private readonly IStripePaymentService _paymentService;
 
     public ResellerClientOrganizationSignUpCommand(
         IOrganizationRepository organizationRepository,
@@ -48,7 +49,7 @@ public class ResellerClientOrganizationSignUpCommand : IResellerClientOrganizati
         IOrganizationUserRepository organizationUserRepository,
         IEventService eventService,
         ISendOrganizationInvitesCommand sendOrganizationInvitesCommand,
-        IPaymentService paymentService)
+        IStripePaymentService paymentService)
     {
         _organizationRepository = organizationRepository;
         _organizationApiKeyRepository = organizationApiKeyRepository;

src/Core/AdminConsole/OrganizationFeatures/Organizations/SelfHostedOrganizationSignUpCommand.cs

@@ -2,6 +2,8 @@
 using Bit.Core.AdminConsole.Entities;
 using Bit.Core.AdminConsole.Enums;
 using Bit.Core.AdminConsole.OrganizationFeatures.Organizations.Interfaces;
+using Bit.Core.AdminConsole.OrganizationFeatures.Policies;
+using Bit.Core.AdminConsole.OrganizationFeatures.Policies.PolicyRequirements;
 using Bit.Core.AdminConsole.Services;
 using Bit.Core.Billing.Organizations.Models;
 using Bit.Core.Billing.Services;
@@ -30,7 +32,9 @@ public class SelfHostedOrganizationSignUpCommand : ISelfHostedOrganizationSignUp
     private readonly ILicensingService _licensingService;
     private readonly IPolicyService _policyService;
     private readonly IGlobalSettings _globalSettings;
-    private readonly IPaymentService _paymentService;
+    private readonly IStripePaymentService _paymentService;
+    private readonly IFeatureService _featureService;
+    private readonly IPolicyRequirementQuery _policyRequirementQuery;
 
     public SelfHostedOrganizationSignUpCommand(
         IOrganizationRepository organizationRepository,
@@ -44,7 +48,9 @@ public class SelfHostedOrganizationSignUpCommand : ISelfHostedOrganizationSignUp
         ILicensingService licensingService,
         IPolicyService policyService,
         IGlobalSettings globalSettings,
-        IPaymentService paymentService)
+        IStripePaymentService paymentService,
+        IFeatureService featureService,
+        IPolicyRequirementQuery policyRequirementQuery)
     {
         _organizationRepository = organizationRepository;
         _organizationUserRepository = organizationUserRepository;
@@ -58,6 +64,8 @@ public class SelfHostedOrganizationSignUpCommand : ISelfHostedOrganizationSignUp
         _policyService = policyService;
         _globalSettings = globalSettings;
         _paymentService = paymentService;
+        _featureService = featureService;
+        _policyRequirementQuery = policyRequirementQuery;
     }
 
     public async Task<(Organization organization, OrganizationUser? organizationUser)> SignUpAsync(
@@ -103,6 +111,17 @@ public class SelfHostedOrganizationSignUpCommand : ISelfHostedOrganizationSignUp
 
     private async Task ValidateSignUpPoliciesAsync(Guid ownerId)
     {
+        if (_featureService.IsEnabled(FeatureFlagKeys.AutomaticConfirmUsers))
+        {
+            var requirement = await _policyRequirementQuery.GetAsync<AutomaticUserConfirmationPolicyRequirement>(ownerId);
+
+            if (requirement.CannotCreateNewOrganization())
+            {
+                throw new BadRequestException("You may not create an organization. You belong to an organization " +
+                                              "which has a policy that prohibits you from being a member of any other organization.");
+            }
+        }
+
         var anySingleOrgPolicies = await _policyService.AnyPoliciesApplicableToUserAsync(ownerId, PolicyType.SingleOrg);
         if (anySingleOrgPolicies)
         {

src/Core/AdminConsole/OrganizationFeatures/Organizations/Update/OrganizationUpdateCommand.cs

@@ -67,7 +67,7 @@ public class OrganizationUpdateCommand(
         var shouldUpdateBilling = originalName != organization.Name ||
                                   originalBillingEmail != organization.BillingEmail;
 
-        if (!shouldUpdateBilling || string.IsNullOrWhiteSpace(organization.GatewayCustomerId))
+        if (!shouldUpdateBilling)
         {
             return;
         }

src/Core/AdminConsole/OrganizationFeatures/Organizations/UpdateOrganizationSubscriptionCommand.cs

@@ -1,12 +1,12 @@
 using Bit.Core.AdminConsole.Models.Data.Organizations;
 using Bit.Core.AdminConsole.OrganizationFeatures.Organizations.Interfaces;
+using Bit.Core.Billing.Services;
 using Bit.Core.Repositories;
-using Bit.Core.Services;
 using Microsoft.Extensions.Logging;
 
 namespace Bit.Core.AdminConsole.OrganizationFeatures.Organizations;
 
-public class UpdateOrganizationSubscriptionCommand(IPaymentService paymentService,
+public class UpdateOrganizationSubscriptionCommand(IStripePaymentService paymentService,
     IOrganizationRepository repository,
     TimeProvider timeProvider,
     ILogger<UpdateOrganizationSubscriptionCommand> logger) : IUpdateOrganizationSubscriptionCommand

src/Core/AdminConsole/OrganizationFeatures/Policies/Enforcement/AutoConfirm/AutomaticUserConfirmationPolicyEnforcementRequest.cs

@@ -0,0 +1,44 @@
+using Bit.Core.Entities;
+
+namespace Bit.Core.AdminConsole.OrganizationFeatures.Policies.Enforcement.AutoConfirm;
+
+/// <summary>
+/// Request object for <see cref="AutomaticUserConfirmationPolicyEnforcementValidator"/>
+/// </summary>
+public record AutomaticUserConfirmationPolicyEnforcementRequest
+{
+    /// <summary>
+    /// Organization to be validated
+    /// </summary>
+    public Guid OrganizationId { get; }
+
+    /// <summary>
+    /// All organization users that match the provided user.
+    /// </summary>
+    public ICollection<OrganizationUser> AllOrganizationUsers { get; }
+
+    /// <summary>
+    /// User associated with the organization user to be confirmed
+    /// </summary>
+    public User User { get; }
+
+    /// <summary>
+    /// Request object for <see cref="AutomaticUserConfirmationPolicyEnforcementValidator"/>.
+    /// </summary>
+    /// <remarks>
+    /// This record is used to encapsulate the data required for handling the automatic confirmation policy enforcement.
+    /// </remarks>
+    /// <param name="organizationId">The organization to be validated.</param>
+    /// <param name="organizationUsers">All organization users that match the provided user.</param>
+    /// <param name="user">The user entity connecting all org users provided.</param>
+    public AutomaticUserConfirmationPolicyEnforcementRequest(
+        Guid organizationId,
+        IEnumerable<OrganizationUser> organizationUsers,
+        User user)
+    {
+        OrganizationId = organizationId;
+        AllOrganizationUsers = organizationUsers.ToArray();
+        User = user;
+    }
+}
+

src/Core/AdminConsole/OrganizationFeatures/Policies/Enforcement/AutoConfirm/AutomaticUserConfirmationPolicyEnforcementValidator.cs

@@ -0,0 +1,50 @@
+using Bit.Core.AdminConsole.OrganizationFeatures.OrganizationUsers.AutoConfirmUser;
+using Bit.Core.AdminConsole.OrganizationFeatures.Policies.PolicyRequirements;
+using Bit.Core.AdminConsole.Repositories;
+using Bit.Core.AdminConsole.Utilities.v2.Validation;
+using static Bit.Core.AdminConsole.Utilities.v2.Validation.ValidationResultHelpers;
+
+namespace Bit.Core.AdminConsole.OrganizationFeatures.Policies.Enforcement.AutoConfirm;
+
+public class AutomaticUserConfirmationPolicyEnforcementValidator(
+    IPolicyRequirementQuery policyRequirementQuery,
+    IProviderUserRepository providerUserRepository)
+    : IAutomaticUserConfirmationPolicyEnforcementValidator
+{
+    public async Task<ValidationResult<AutomaticUserConfirmationPolicyEnforcementRequest>> IsCompliantAsync(
+        AutomaticUserConfirmationPolicyEnforcementRequest request)
+    {
+        var automaticUserConfirmationPolicyRequirement = await policyRequirementQuery
+            .GetAsync<AutomaticUserConfirmationPolicyRequirement>(request.User.Id);
+
+        var currentOrganizationUser = request.AllOrganizationUsers
+            .FirstOrDefault(x => x.OrganizationId == request.OrganizationId
+                                 // invited users do not have a userId but will have email
+                                 && (x.UserId == request.User.Id || x.Email == request.User.Email));
+
+        if (currentOrganizationUser is null)
+        {
+            return Invalid(request, new CurrentOrganizationUserIsNotPresentInRequest());
+        }
+
+        if (automaticUserConfirmationPolicyRequirement.IsEnabled(request.OrganizationId))
+        {
+            if ((await providerUserRepository.GetManyByUserAsync(request.User.Id)).Count != 0)
+            {
+                return Invalid(request, new ProviderUsersCannotJoin());
+            }
+
+            if (request.AllOrganizationUsers.Count > 1)
+            {
+                return Invalid(request, new UserCannotBelongToAnotherOrganization());
+            }
+        }
+
+        if (automaticUserConfirmationPolicyRequirement.IsEnabledForOrganizationsOtherThan(currentOrganizationUser.OrganizationId))
+        {
+            return Invalid(request, new OtherOrganizationDoesNotAllowOtherMembership());
+        }
+
+        return Valid(request);
+    }
+}

src/Core/AdminConsole/OrganizationFeatures/Policies/Enforcement/AutoConfirm/IAutomaticUserConfirmationPolicyEnforcementValidator.cs

@@ -0,0 +1,28 @@
+using Bit.Core.AdminConsole.OrganizationFeatures.Policies.PolicyRequirements;
+using Bit.Core.AdminConsole.Utilities.v2.Validation;
+
+namespace Bit.Core.AdminConsole.OrganizationFeatures.Policies.Enforcement.AutoConfirm;
+
+/// <summary>
+/// Used to enforce the Automatic User Confirmation policy. It uses the <see cref="IPolicyRequirementQuery"/> to retrieve
+/// the <see cref="AutomaticUserConfirmationPolicyRequirement"/>. It is used to check to make sure the given user is
+/// valid for the Automatic User Confirmation policy. It also validates that the given user is not a provider
+/// or a member of another organization regardless of status or type.
+/// </summary>
+public interface IAutomaticUserConfirmationPolicyEnforcementValidator
+{
+
+    /// <summary>
+    /// Checks if the given user is compliant with the Automatic User Confirmation policy.
+    ///
+    /// To be compliant, a user must
+    /// - not be a member of a provider
+    /// - not be a member of another organization
+    /// </summary>
+    /// <param name="request"></param>
+    /// <remarks>
+    /// This uses the validation result pattern to avoid throwing exceptions.
+    /// </remarks>
+    /// <returns>A validation result with the error message if applicable.</returns>
+    Task<ValidationResult<AutomaticUserConfirmationPolicyEnforcementRequest>> IsCompliantAsync(AutomaticUserConfirmationPolicyEnforcementRequest request);
+}

src/Core/AdminConsole/OrganizationFeatures/Policies/PolicyRequirements/AutomaticUserConfirmationPolicyRequirement.cs

@@ -0,0 +1,48 @@
+using Bit.Core.AdminConsole.Enums;
+using Bit.Core.AdminConsole.Models.Data.Organizations.Policies;
+using Bit.Core.Enums;
+
+namespace Bit.Core.AdminConsole.OrganizationFeatures.Policies.PolicyRequirements;
+
+/// <summary>
+/// Represents the enforcement status of the Automatic User Confirmation policy.
+/// </summary>
+/// <remarks>
+/// The Automatic User Confirmation policy is enforced against all types of users regardless of status or type.
+///
+/// Users cannot:
+/// <ul>
+/// <li>Be a member of another organization (similar to Single Organization Policy)</li>
+/// <li>Cannot be a provider</li>
+/// </ul>
+/// </remarks>
+/// <param name="policyDetails">Collection of policy details that apply to this user id</param>
+public class AutomaticUserConfirmationPolicyRequirement(IEnumerable<PolicyDetails> policyDetails) : IPolicyRequirement
+{
+    public bool CannotBeGrantedEmergencyAccess() => policyDetails.Any();
+
+    public bool CannotJoinProvider() => policyDetails.Any();
+
+    public bool CannotCreateProvider() => policyDetails.Any();
+
+    public bool CannotCreateNewOrganization() => policyDetails.Any();
+
+    public bool IsEnabled(Guid organizationId) => policyDetails.Any(p => p.OrganizationId == organizationId);
+
+    public bool IsEnabledForOrganizationsOtherThan(Guid organizationId) =>
+        policyDetails.Any(p => p.OrganizationId != organizationId);
+}
+
+public class AutomaticUserConfirmationPolicyRequirementFactory : BasePolicyRequirementFactory<AutomaticUserConfirmationPolicyRequirement>
+{
+    public override PolicyType PolicyType => PolicyType.AutomaticUserConfirmation;
+
+    protected override IEnumerable<OrganizationUserType> ExemptRoles => [];
+
+    protected override IEnumerable<OrganizationUserStatusType> ExemptStatuses => [];
+
+    protected override bool ExemptProviders => false;
+
+    public override AutomaticUserConfirmationPolicyRequirement Create(IEnumerable<PolicyDetails> policyDetails) =>
+        new(policyDetails);
+}

src/Core/AdminConsole/OrganizationFeatures/Policies/PolicyServiceCollectionExtensions.cs

@@ -1,4 +1,5 @@
-using Bit.Core.AdminConsole.OrganizationFeatures.Policies.Implementations;
+using Bit.Core.AdminConsole.OrganizationFeatures.Policies.Enforcement.AutoConfirm;
+using Bit.Core.AdminConsole.OrganizationFeatures.Policies.Implementations;
 using Bit.Core.AdminConsole.OrganizationFeatures.Policies.PolicyRequirements;
 using Bit.Core.AdminConsole.OrganizationFeatures.Policies.PolicyUpdateEvents;
 using Bit.Core.AdminConsole.OrganizationFeatures.Policies.PolicyUpdateEvents.Interfaces;
@@ -23,6 +24,8 @@ public static class PolicyServiceCollectionExtensions
         services.AddPolicyRequirements();
         services.AddPolicySideEffects();
         services.AddPolicyUpdateEvents();
+
+        services.AddScoped<IAutomaticUserConfirmationPolicyEnforcementValidator, AutomaticUserConfirmationPolicyEnforcementValidator>();
     }
 
     [Obsolete("Use AddPolicyUpdateEvents instead.")]
@@ -69,5 +72,6 @@ public static class PolicyServiceCollectionExtensions
         services.AddScoped<IPolicyRequirementFactory<IPolicyRequirement>, RequireTwoFactorPolicyRequirementFactory>();
         services.AddScoped<IPolicyRequirementFactory<IPolicyRequirement>, MasterPasswordPolicyRequirementFactory>();
         services.AddScoped<IPolicyRequirementFactory<IPolicyRequirement>, SingleOrganizationPolicyRequirementFactory>();
+        services.AddScoped<IPolicyRequirementFactory<IPolicyRequirement>, AutomaticUserConfirmationPolicyRequirementFactory>();
     }
 }

src/Core/AdminConsole/Services/IIntegrationHandler.cs

@@ -29,46 +29,87 @@ public abstract class IntegrationHandlerBase<T> : IIntegrationHandler<T>
         IntegrationMessage<T> message,
         TimeProvider timeProvider)
     {
-        var result = new IntegrationHandlerResult(success: response.IsSuccessStatusCode, message);
-
-        if (response.IsSuccessStatusCode) return result;
-
-        switch (response.StatusCode)
+        if (response.IsSuccessStatusCode)
         {
-            case HttpStatusCode.TooManyRequests:
-            case HttpStatusCode.RequestTimeout:
-            case HttpStatusCode.InternalServerError:
-            case HttpStatusCode.BadGateway:
-            case HttpStatusCode.ServiceUnavailable:
-            case HttpStatusCode.GatewayTimeout:
-                result.Retryable = true;
-                result.FailureReason = response.ReasonPhrase ?? $"Failure with status code: {(int)response.StatusCode}";
-
-                if (response.Headers.TryGetValues("Retry-After", out var values))
-                {
-                    var value = values.FirstOrDefault();
-                    if (int.TryParse(value, out var seconds))
-                    {
-                        // Retry-after was specified in seconds. Adjust DelayUntilDate by the requested number of seconds.
-                        result.DelayUntilDate = timeProvider.GetUtcNow().AddSeconds(seconds).UtcDateTime;
-                    }
-                    else if (DateTimeOffset.TryParseExact(value,
-                                 "r", // "r" is the round-trip format: RFC1123
-                                 CultureInfo.InvariantCulture,
-                                 DateTimeStyles.AssumeUniversal | DateTimeStyles.AdjustToUniversal,
-                                 out var retryDate))
-                    {
-                        // Retry-after was specified as a date. Adjust DelayUntilDate to the specified date.
-                        result.DelayUntilDate = retryDate.UtcDateTime;
-                    }
-                }
-                break;
-            default:
-                result.Retryable = false;
-                result.FailureReason = response.ReasonPhrase ?? $"Failure with status code {(int)response.StatusCode}";
-                break;
+            return IntegrationHandlerResult.Succeed(message);
         }
 
-        return result;
+        var category = ClassifyHttpStatusCode(response.StatusCode);
+        var failureReason = response.ReasonPhrase ?? $"Failure with status code {(int)response.StatusCode}";
+
+        if (category is not (IntegrationFailureCategory.RateLimited
+                or IntegrationFailureCategory.TransientError
+                or IntegrationFailureCategory.ServiceUnavailable) ||
+            !response.Headers.TryGetValues("Retry-After", out var values)
+           )
+        {
+            return IntegrationHandlerResult.Fail(message: message, category: category, failureReason: failureReason);
+        }
+
+        // Handle Retry-After header for rate-limited and retryable errors
+        DateTime? delayUntil = null;
+        var value = values.FirstOrDefault();
+        if (int.TryParse(value, out var seconds))
+        {
+            // Retry-after was specified in seconds
+            delayUntil = timeProvider.GetUtcNow().AddSeconds(seconds).UtcDateTime;
+        }
+        else if (DateTimeOffset.TryParseExact(value,
+                     "r", // "r" is the round-trip format: RFC1123
+                     CultureInfo.InvariantCulture,
+                     DateTimeStyles.AssumeUniversal | DateTimeStyles.AdjustToUniversal,
+                     out var retryDate))
+        {
+            // Retry-after was specified as a date
+            delayUntil = retryDate.UtcDateTime;
+        }
+
+        return IntegrationHandlerResult.Fail(
+            message,
+            category,
+            failureReason,
+            delayUntil
+        );
+    }
+
+    /// <summary>
+    /// Classifies an <see cref="HttpStatusCode"/> as an <see cref="IntegrationFailureCategory"/> to drive
+    /// retry behavior and operator-facing failure reporting.
+    /// </summary>
+    /// <param name="statusCode">The HTTP status code.</param>
+    /// <returns>The corresponding <see cref="IntegrationFailureCategory"/>.</returns>
+    protected static IntegrationFailureCategory ClassifyHttpStatusCode(HttpStatusCode statusCode)
+    {
+        var explicitCategory = statusCode switch
+        {
+            HttpStatusCode.Unauthorized => IntegrationFailureCategory.AuthenticationFailed,
+            HttpStatusCode.Forbidden => IntegrationFailureCategory.AuthenticationFailed,
+            HttpStatusCode.NotFound => IntegrationFailureCategory.ConfigurationError,
+            HttpStatusCode.Gone => IntegrationFailureCategory.ConfigurationError,
+            HttpStatusCode.MovedPermanently => IntegrationFailureCategory.ConfigurationError,
+            HttpStatusCode.TemporaryRedirect => IntegrationFailureCategory.ConfigurationError,
+            HttpStatusCode.PermanentRedirect => IntegrationFailureCategory.ConfigurationError,
+            HttpStatusCode.TooManyRequests => IntegrationFailureCategory.RateLimited,
+            HttpStatusCode.RequestTimeout => IntegrationFailureCategory.TransientError,
+            HttpStatusCode.InternalServerError => IntegrationFailureCategory.TransientError,
+            HttpStatusCode.BadGateway => IntegrationFailureCategory.TransientError,
+            HttpStatusCode.GatewayTimeout => IntegrationFailureCategory.TransientError,
+            HttpStatusCode.ServiceUnavailable => IntegrationFailureCategory.ServiceUnavailable,
+            HttpStatusCode.NotImplemented => IntegrationFailureCategory.PermanentFailure,
+            _ => (IntegrationFailureCategory?)null
+        };
+
+        if (explicitCategory is not null)
+        {
+            return explicitCategory.Value;
+        }
+
+        return (int)statusCode switch
+        {
+            >= 300 and <= 399 => IntegrationFailureCategory.ConfigurationError,
+            >= 400 and <= 499 => IntegrationFailureCategory.ConfigurationError,
+            >= 500 and <= 599 => IntegrationFailureCategory.ServiceUnavailable,
+            _ => IntegrationFailureCategory.ServiceUnavailable
+        };
     }
 }

src/Core/AdminConsole/Services/IOrganizationIntegrationConfigurationValidator.cs

@@ -0,0 +1,17 @@
+using Bit.Core.AdminConsole.Entities;
+using Bit.Core.Enums;
+
+namespace Bit.Core.AdminConsole.Services;
+
+public interface IOrganizationIntegrationConfigurationValidator
+{
+    /// <summary>
+    /// Validates that the configuration is valid for the given integration type. The configuration must
+    /// include a Configuration that is valid for the type, valid Filters, and a non-empty Template
+    /// to pass validation.
+    /// </summary>
+    /// <param name="integrationType">The type of integration</param>
+    /// <param name="configuration">The OrganizationIntegrationConfiguration to validate</param>
+    /// <returns>True if valid, false otherwise</returns>
+    bool ValidateConfiguration(IntegrationType integrationType, OrganizationIntegrationConfiguration configuration);
+}

src/Core/AdminConsole/Services/Implementations/EventIntegrations/AzureServiceBusIntegrationListenerService.cs

@@ -85,6 +85,17 @@ public class AzureServiceBusIntegrationListenerService<TConfiguration> : Backgro
             {
                 // Non-recoverable failure or exceeded the max number of retries
                 // Return false to indicate this message should be dead-lettered
+                _logger.LogWarning(
+                    "Integration failure - non-recoverable error or max retries exceeded. " +
+                    "MessageId: {MessageId}, IntegrationType: {IntegrationType}, OrganizationId: {OrgId}, " +
+                    "FailureCategory: {Category}, Reason: {Reason}, RetryCount: {RetryCount}, MaxRetries: {MaxRetries}",
+                    message.MessageId,
+                    message.IntegrationType,
+                    message.OrganizationId,
+                    result.Category,
+                    result.FailureReason,
+                    message.RetryCount,
+                    _maxRetries);
                 return false;
             }
         }

src/Core/AdminConsole/Services/Implementations/EventIntegrations/RabbitMqIntegrationListenerService.cs

@@ -106,14 +106,32 @@ public class RabbitMqIntegrationListenerService<TConfiguration> : BackgroundServ
                 {
                     // Exceeded the max number of retries; fail and send to dead letter queue
                     await _rabbitMqService.PublishToDeadLetterAsync(channel, message, cancellationToken);
-                    _logger.LogWarning("Max retry attempts reached. Sent to DLQ.");
+                    _logger.LogWarning(
+                        "Integration failure - max retries exceeded. " +
+                        "MessageId: {MessageId}, IntegrationType: {IntegrationType}, OrganizationId: {OrgId}, " +
+                        "FailureCategory: {Category}, Reason: {Reason}, RetryCount: {RetryCount}, MaxRetries: {MaxRetries}",
+                        message.MessageId,
+                        message.IntegrationType,
+                        message.OrganizationId,
+                        result.Category,
+                        result.FailureReason,
+                        message.RetryCount,
+                        _maxRetries);
                 }
             }
             else
             {
                 // Fatal error (i.e. not retryable) occurred. Send message to dead letter queue without any retries
                 await _rabbitMqService.PublishToDeadLetterAsync(channel, message, cancellationToken);
-                _logger.LogWarning("Non-retryable failure. Sent to DLQ.");
+                _logger.LogWarning(
+                    "Integration failure - non-retryable. " +
+                    "MessageId: {MessageId}, IntegrationType: {IntegrationType}, OrganizationId: {OrgId}, " +
+                    "FailureCategory: {Category}, Reason: {Reason}",
+                    message.MessageId,
+                    message.IntegrationType,
+                    message.OrganizationId,
+                    result.Category,
+                    result.FailureReason);
             }
 
             // Message has been sent to retry or dead letter queues.

src/Core/AdminConsole/Services/Implementations/EventIntegrations/SlackIntegrationHandler.cs

@@ -6,15 +6,6 @@ public class SlackIntegrationHandler(
     ISlackService slackService)
     : IntegrationHandlerBase<SlackIntegrationConfigurationDetails>
 {
-    private static readonly HashSet<string> _retryableErrors = new(StringComparer.Ordinal)
-        {
-            "internal_error",
-            "message_limit_exceeded",
-            "rate_limited",
-            "ratelimited",
-            "service_unavailable"
-        };
-
     public override async Task<IntegrationHandlerResult> HandleAsync(IntegrationMessage<SlackIntegrationConfigurationDetails> message)
     {
         var slackResponse = await slackService.SendSlackMessageByChannelIdAsync(
@@ -25,24 +16,61 @@ public class SlackIntegrationHandler(
 
         if (slackResponse is null)
         {
-            return new IntegrationHandlerResult(success: false, message: message)
-            {
-                FailureReason = "Slack response was null"
-            };
+            return IntegrationHandlerResult.Fail(
+                message,
+                IntegrationFailureCategory.TransientError,
+                "Slack response was null"
+            );
         }
 
         if (slackResponse.Ok)
         {
-            return new IntegrationHandlerResult(success: true, message: message);
+            return IntegrationHandlerResult.Succeed(message);
         }
 
-        var result = new IntegrationHandlerResult(success: false, message: message) { FailureReason = slackResponse.Error };
+        var category = ClassifySlackError(slackResponse.Error);
+        return IntegrationHandlerResult.Fail(
+            message,
+            category,
+            slackResponse.Error
+        );
+    }
 
-        if (_retryableErrors.Contains(slackResponse.Error))
+    /// <summary>
+    /// Classifies a Slack API error code string as an <see cref="IntegrationFailureCategory"/> to drive
+    /// retry behavior and operator-facing failure reporting.
+    /// </summary>
+    /// <remarks>
+    /// <para>
+    /// Slack responses commonly return an <c>error</c> string when <c>ok</c> is false. This method maps
+    /// known Slack error codes to failure categories.
+    /// </para>
+    /// <para>
+    /// Any unrecognized error codes default to <see cref="IntegrationFailureCategory.TransientError"/> to avoid
+    /// incorrectly marking new/unknown Slack failures as non-retryable.
+    /// </para>
+    /// </remarks>
+    /// <param name="error">The Slack error code string (e.g. <c>invalid_auth</c>, <c>rate_limited</c>).</param>
+    /// <returns>The corresponding <see cref="IntegrationFailureCategory"/>.</returns>
+    private static IntegrationFailureCategory ClassifySlackError(string error)
+    {
+        return error switch
         {
-            result.Retryable = true;
-        }
-
-        return result;
+            "invalid_auth" => IntegrationFailureCategory.AuthenticationFailed,
+            "access_denied" => IntegrationFailureCategory.AuthenticationFailed,
+            "token_expired" => IntegrationFailureCategory.AuthenticationFailed,
+            "token_revoked" => IntegrationFailureCategory.AuthenticationFailed,
+            "account_inactive" => IntegrationFailureCategory.AuthenticationFailed,
+            "not_authed" => IntegrationFailureCategory.AuthenticationFailed,
+            "channel_not_found" => IntegrationFailureCategory.ConfigurationError,
+            "is_archived" => IntegrationFailureCategory.ConfigurationError,
+            "rate_limited" => IntegrationFailureCategory.RateLimited,
+            "ratelimited" => IntegrationFailureCategory.RateLimited,
+            "message_limit_exceeded" => IntegrationFailureCategory.RateLimited,
+            "internal_error" => IntegrationFailureCategory.TransientError,
+            "service_unavailable" => IntegrationFailureCategory.ServiceUnavailable,
+            "fatal_error" => IntegrationFailureCategory.ServiceUnavailable,
+            _ => IntegrationFailureCategory.TransientError
+        };
     }
 }

src/Core/AdminConsole/Services/Implementations/EventIntegrations/TeamsIntegrationHandler.cs

@@ -1,4 +1,5 @@
-using Bit.Core.AdminConsole.Models.Data.EventIntegrations;
+using System.Text.Json;
+using Bit.Core.AdminConsole.Models.Data.EventIntegrations;
 using Microsoft.Rest;
 
 namespace Bit.Core.Services;
@@ -18,24 +19,48 @@ public class TeamsIntegrationHandler(
                 channelId: message.Configuration.ChannelId
             );
 
-            return new IntegrationHandlerResult(success: true, message: message);
+            return IntegrationHandlerResult.Succeed(message);
         }
         catch (HttpOperationException ex)
         {
-            var result = new IntegrationHandlerResult(success: false, message: message);
-            var statusCode = (int)ex.Response.StatusCode;
-            result.Retryable = statusCode is 429 or >= 500 and < 600;
-            result.FailureReason = ex.Message;
-
-            return result;
+            var category = ClassifyHttpStatusCode(ex.Response.StatusCode);
+            return IntegrationHandlerResult.Fail(
+                message,
+                category,
+                ex.Message
+            );
+        }
+        catch (ArgumentException ex)
+        {
+            return IntegrationHandlerResult.Fail(
+                message,
+                IntegrationFailureCategory.ConfigurationError,
+                ex.Message
+            );
+        }
+        catch (UriFormatException ex)
+        {
+            return IntegrationHandlerResult.Fail(
+                message,
+                IntegrationFailureCategory.ConfigurationError,
+                ex.Message
+            );
+        }
+        catch (JsonException ex)
+        {
+            return IntegrationHandlerResult.Fail(
+                message,
+                IntegrationFailureCategory.PermanentFailure,
+                ex.Message
+            );
         }
         catch (Exception ex)
         {
-            var result = new IntegrationHandlerResult(success: false, message: message);
-            result.Retryable = false;
-            result.FailureReason = ex.Message;
-
-            return result;
+            return IntegrationHandlerResult.Fail(
+                message,
+                IntegrationFailureCategory.TransientError,
+                ex.Message
+            );
         }
     }
 }

src/Core/AdminConsole/Services/Implementations/OrganizationService.cs

@@ -21,6 +21,7 @@ using Bit.Core.Billing.Constants;
 using Bit.Core.Billing.Enums;
 using Bit.Core.Billing.Extensions;
 using Bit.Core.Billing.Pricing;
+using Bit.Core.Billing.Services;
 using Bit.Core.Context;
 using Bit.Core.Entities;
 using Bit.Core.Enums;
@@ -47,7 +48,7 @@ public class OrganizationService : IOrganizationService
     private readonly IPushNotificationService _pushNotificationService;
     private readonly IEventService _eventService;
     private readonly IApplicationCacheService _applicationCacheService;
-    private readonly IPaymentService _paymentService;
+    private readonly IStripePaymentService _paymentService;
     private readonly IPolicyRepository _policyRepository;
     private readonly IPolicyService _policyService;
     private readonly ISsoUserRepository _ssoUserRepository;
@@ -74,7 +75,7 @@ public class OrganizationService : IOrganizationService
         IPushNotificationService pushNotificationService,
         IEventService eventService,
         IApplicationCacheService applicationCacheService,
-        IPaymentService paymentService,
+        IStripePaymentService paymentService,
         IPolicyRepository policyRepository,
         IPolicyService policyService,
         ISsoUserRepository ssoUserRepository,
@@ -358,7 +359,7 @@ public class OrganizationService : IOrganizationService
         {
             var newDisplayName = organization.DisplayName();
 
-            await _stripeAdapter.CustomerUpdateAsync(organization.GatewayCustomerId,
+            await _stripeAdapter.UpdateCustomerAsync(organization.GatewayCustomerId,
                 new CustomerUpdateOptions
                 {
                     Email = organization.BillingEmail,